You're right, that's definitely a possible attack vector (besides a malicious coordinator, who can just do that by only paying miner fees).

I never thought of that. But still don't understand how allowing more than 1 utxo being remixed per client would sove it... Sounds like it would just make it easier to attack