It is just about possible to implement this logic, but I agree that it's horribly painful to do so. On the other hand, I think direct fine-grained logic like this is probably best implemented in the AbuseFilter; I'd say that protection should continue to be based on user groups.
