UBO also let's you limit attachment size. Eg you can configure it to block anything larger than 100KB. Not sure what it does without Content-Length header though.