it doesn't explicitly forbdit it. It just doesn't spec it out, because it doesn't need it for the protocol to work. There are already many relays and clients that do just this.
This would be like the HTTP protocol not defining `POST`, and leaving it up to servers and clients to implement it based on however it feels like.
I really like the ideals behind Nostr, but I think its implementation and execution could be better.
The Nostr spec covers what matters, cryptographic identities and unique message ids, that make dumb relays that duplicating messages from elsewhere possible (an area where HTTP or Activity Pub fail at).