This is an ongoing problem for our organisation also and I was hoping to find information on adjusting business rules to handle this but here we are.

Investigating this issue from a user-behaviour context revealed more information that may be of some use:

What is occurring has been well established (multiple zendesk customer organisations are reporting the same mechanism causing the defect and resulting in a set of common issues.

The main assumption as to why this has happened is end-users actively locating and replying to a previous e-mail update from a recent support ticket to raise a new issue - this was the thinking here and at other organisations based on the comments above, and also fits as to why Zendesk wouldn't have predicted this to eventuate as a common issue because surely any rate of non-genuine followup emails would be negligible and due to mistakes. Another theme is end-user behaviour not changing in any meaningful way even after the issue being communicated - I bet there isn't any queries raised either.

End-users aren't doing this in these volumes - they are starting a new email to raise a support case and as they type in the support contact or address name, their e-mail client will show automatically cached recently used addresses (including unique support addresses from previous tickets), and as the support e-mail address Display Name sent to end users for previous cases is often the same as the regular support contact they hit tab or enter without realising that the trailing email address <support+id******-****@********.zendesk.com> will be processed as a follow-up.

It explains why end-users continue to do this even after being asked not to and reasonably explains why this problem wasn't identified during development and testing. It is still largely a theory, but if you can add a prefix to the display name on outbound messages to end users and create self-service instructions to remove the autocached zendesk addresses from their email client and see if there is a reduction in volumes of defect follow-up tickets created it may help.