Wouldn't a simple mitigation be to limit the number of recipients allowed in the 'to' and 'cc' fields? 'Bcc' can be used for the mega mailouts. That way, a user hitting reply-all sends to a much more limited set of addresses.