I had written this this in assuming it would be cheap.  (As it would be if `items` was a queryset).  However, this bit of logic doesn't account for your usage where each item in items is expensive to compute, as your reports need.  So maybe this protection should actually use some newly created function that estimate of the number of sql queries, or somesuch.  

Or we can change the entire thing to a celery task, potentially, that then uploads to S3 + emails the requester?

I'm not sure this has to block the PR, especially if testing it on a dev machine shows that your reports do work, but I think something has to be done at some point to ensure that the request handler is able to complete under whatever timeout value.