Since friends aren't one way it's possible to receive a message from someone not in your friends list. You could do a backup get request for the user, but can't you just include the user json in the message?