I went ahead and updated the product so that it cannot be circumvented by manually calling the report script. If a user does not have permission to report a post for any reason, then they are now shown the "no permission" page if they attempt to call the report script for that post.
The other updates I have planned will take much more time, and so I wanted to go ahead and implement this functionality now.