Is there any protection from trolls sending mail to this address? Yes, one can roll back the change, but an automated attack would win.

Perhaps the address should be an unguessable <GUID>@ngrok.org instead? Or do you validate SPF and only accept mail from your ISP?

(Maybe you already have solutions; I just found it interesting to consider abuse of the system.)