Sean, yes that 'Privacy' thing should work, but isn't this like other Hotmail spam? You only have to open a Hotmail account, as we all know, to be bombarded with crap, before you've even used your address! I'm sure that the 'uninvited guests' in Messenger must logically use the same method of detecting (guessing?) Hotmail addresses, to see if they can get a response anywhere.
It is possible to use Messenger without having a Hotmail account (some people don't realise that), and if you have an existing e-mail address which is relatively well protected against spam (by the ISP), could that not be another solution?