I am ok with allowing admin to pass it through a regex and adding a site setting.
Building a whitelist of every unicode that is valid and known to man is not easy, also zalgotext may be “valid” in your local its just that its overdoing it.
I don’t think this battle can easily be beaten by computers. Its why you have a flag button.