It did occur to me. I'm not sure I have a good response.

Note that it is possible to do this sort of thing today, if a subscriber's event delivery results in more events being sent to that same subscriber.

To mitigate the danger, maybe we could release the scheduler (i.e., reschedule ourselves) after the event that the calling thread enqueued has been delivered? This would prevent the scheduler from being wholly owned by other threads, but still maintain all the guarantees we need, I think.