There's an ongoing wave of spam that automatically adds calendar events into your iCloud accounts. The issue, besides being annoying, is that it's not easy to delete the events without rejecting them, which will send a confirmation that your email is valid back to the spammer.
To solve this, login into https://www.icloud.com, go to "Calendar" -> "Settings" (icon on the lower left corner) -> "Preferences" -> "Advanced" tab -> and then switch the "Invitations" option to "Email" instead of "In-App".
This way the iCal invitations won't be automatically added into the calendar, by the server, but instead the original spam will remain on the inbox, or hopefully on the junk folder.
To delete the events already on the calendar, open iCal (it may also work on the web), create a new temporary calendar on the relevant account, click on the spam calendar event, click on the top right corner, move the event into the newly created calendar, then click back on iCal to dismiss the calendar detail bubble without accepting or rejecting it. Repeat for any other spam event. At the end, delete the whole calendar folder and select "don't send confirmations" on the popup that follows.
Apple has already been informed to recover the option to delete events without the need to reply back, which existed many many moons ago. If you are a developer, help us by open yet another bug on radar, so they see those duplicates and get it fixed.
There is a similar "attack" involving shared photo folder invitations when using Photo iCloud, but for this case I haven't yet been attacked, nor I know any solution to avoid it.
Bruno Rodrigues, Lead Principal Software Engineer at AnubisNetworks
30th November, 2016