It’s honestly a little challenging to validate every little thing, due to the way the queue works. The (perhaps wrong) assumption I made when designing it was that the staff member had to approve it anyway, so the validation was less important.
Having said that, I did manage to get a bunch more validation in place, including the length:
https://github.com/discourse/discourse/commit/2c9a47dda511a15efbf4ee4e92bee0b0f7b07def