diff --git a/synapse/handlers/message.py b/synapse/handlers/message.py
index baf372fda..7939d2bff 100644
--- a/synapse/handlers/message.py
+++ b/synapse/handlers/message.py
@@ -154,6 +154,11 @@ class MessageHandler(BaseHandler):
 
         self.validator.validate_new(builder)
 
+        self.ratelimit(builder.user_id)
+        # TODO(paul): Why does 'event' not have a 'user' object?
+        user = self.hs.parse_userid(builder.user_id)
+        assert self.hs.is_mine(user), "User must be our own: %s" % (user,)
+
         if builder.type == EventTypes.Member:
             membership = builder.content.get("membership", None)
             if membership == Membership.JOIN: