Validate incoming event data

I used a similar structure for validation as that in the notification rules, and also refactored that slightly.

I think I've covered all allowed data states, but we can always add any I've missed.

Fixes #411.