iCloud users bombarded by Calendar invitation spam, Apple acknowledges the issue
We are sorry that some of our users are receiving spam calendar invitations. We are actively working to address this issue by identifying and blocking suspicious senders and spam in the invites being sent.
In the meantime, you don't want to interact with these invitations too much. Even if you decline one, the spammers will still get confirmation that this email is, indeed, an active and existing iCloud account ("x" has denied your invitations) and may target you more often.
Users have found two workaround solutions for now, at least until Apple manages to filter out the spam. One is to set your Calendar to receive invitations via email instead of popping them in the app. To do so, you need to visit the iCloud website on desktop, go to Calendar, Preferences, Advanced and set the "Receive event invitations as:" to "Email". Alternatively, every time you get a spam invite, you can create a new calendar within the app, move the spam invites to it, and then delete the calendar without responding to the invitation. That'll get rid of it without sending a message to the original sender.
sources: Rene Ritchie; OSXDaily
Things that are NOT allowed: