Trust level 1 is not a safe setting to allow group PMs.
Regardless I support a lower cap on public mentions and group PM recipients.
@techapj can you check, I don’t see a site setting for max PM recipients, other than max notifications which is 100. If we are missing a limit setting here we need one.