This biggest problem is actually with denial of service attacks. If someone sends out a string of queries with your ip address, your internet connection becomes toast.

But you could send query hits back with only the iport and the number of results. The querier could then connect to that ip address for the actual results. This wouldn't reduce the number of query hits, but it would make packet sizes much smaller (especially if the query hits contain a lot of metadata).

See the second part of this message:
http://groups.yahoo.com/group/the_gdf/message/4834

As for pongs, pings are no longer broadcast so they're fine the way they are.