When guests view a profile they cannot see the actions block, yet just like the security issue with the guest book, a greeting can be sent to anyone as long as you know the member id. If fact, I think web crawlers like googlebot are triggering greetings because no confirmation is required.

I think greetings should default to requiring a member be logged in to send it.