how would an attacker get any response out of the relay unless the relay doesn't refuse to delete events for an npub with a signature proving it comes from the npub?

i guess... strfry does by default then?