Indeed since clients have a websocket connection to stream incoming messages, it should be nigh indistinguishable for them from a regular clients.

Also, the API abuse they are worried about is spam and scams, so just pulling out messages is likely to be the last of their problems.