Actually, a fraudster can design their system such that when preview service is the one rendering the page, it returns an error, but when a legit user is making

Actually, a fraudster can design their system such that when preview service is the one rendering the page, it returns an error, but when a legit user is making the request, it may proceed showing bad stuff. This is known as cloaking. Safe thing to do is to block the submission instead of letting it through anyway, or potentially downrank the tweet, or graylist or whatever, or put it into failed queue for investigation, or something along thoselines. I think crowd here would be delighted when twitter allows spam links because they figured out a way to fool the preview service in some ways.