It is OPTIONAL for the value of the 'id' attribute to be unique globally, within a domain, or within a stream. The semantics of IQ stanzas impose additional restrictions; see IQ Semantics (IQ Semantics).
The "additional restrictions" as discussed in IQ Semantics is really the following:
So, in conclusion, there doesn't seem to be a hard and fast rule. It's entirely legit (although probably a bad idea) to just an empty string as your id. Looking at my console, I noticed that Pidgin used the word "purple" (since Pidgin uses the "libpurple" library) plus what appeared to be an incrementing hexadecimal number...