It seems that they forget to give some operations proper size information -> some ops are free to spam. As they have no size, they can be broadcasted from an account with zero BLURT and zero BLURT Power.