I guess an easy fix for that particular issue is to severely rate limit mentions. E.g. if a user mentions more than 100 users in 1 hour then delay them and flag the account. Then you can whitelist it if it's a legit CI bot or whatever.