yes, could. in practice even functioning exchanges opt not to bother. it is a poor practice we should call out, this is definitely something that a regulatory framework could address and carve out procedures for. (people could do spam attacks, so there is a line on how much to bother)