In general, S2S implementations assume that all users on a remote domain can be trusted. This allows remote users to spam local users with subscription requests, presence or messages. XMPP privacy gives users the opportunity to block spammers, but it might be worth have a global facility to detect/block/throttle S2S traffic.