This has been thought about.
In the fansign script that I sell (and that Melissa uses..) - URLS are encrypted so that users can't simply look at a picture, and type their own message - and it also has a banned word list to prevent this type of thing happening.
I'll have a chat to the guys to make sure they are using both features
