clients could then be overwhelmed with mass invalid messages by bad actors

It could be a shared responsibility to filter these out, similarly to email spam.

Both by users and by relay\storage services.