Block attempts to use @here / @everyone by default

[James Lu]

Currently this can be worked around via permissions, but it's not great that we allow sending this by default.