The requests are authorized, by authenticated users. Facebook could just deny the requests or rate limit. Or stop offering the unfollow feature (which they keep moving and hiding).