Clients have to handle this better

IMO the same way blocking implies a default of "allow", clients should have a way to set the default to "deny".

Otherwise a bot army (or swathes of white knights defending m'lady?) could cause anyone's inbox who was mentioned to blow up.

New ones can pile on faster than anyone can block them.