> are there known attack vectors exercising some bugs in nonce code or
smth like that? 

Not that I know of.

> I am still not sure if banning on something occurring in
regular use is something we should by default do here.

A correctly implemented client will never trigger these errors. A poorly implemented brute forcing tool probably will.

> well... what if many users come through the same proxy? ... once again
-- unless there is a very good reason, we should not ban on messages
associated with non-malicious use.

This is not new behaviour. The apache-auth regex, before it was broken, has always caught the original fail. I've not introduced new behaviour here, just a bunch of regexs that match the same behaviour for different authentication types.