Every rule in Doji is enforced by the contracts. Run these attacks yourself. Nothing is sent: each one is simulated against the live contracts on Mezo testnet, and you see exactly how the contract refuses it.
Simulating from 0x000000000000000000000000000000000000dEaD, an address with no rights in Doji. to run these from your own address.
Found a way through? Open an issue on GitHub.