What this person said for the grab event to find where it came from and sonarr also has a new setting per indexer to fail unsafe downloads, the only drawback is you have to let your downloader download the file in the first place.

The alternative is blocking the files with your download client by extension and then manual intervention.

You need your drain line scoped for obstructions. You could possibly diy it to a certain length but it may not be enough.