Works for me (so far):

map $query_string $bad_query {
"~[^&;]+([&;][^&;]*){1,}" 1; # deny two or more parameters
"~emailaddress=[^@]+%40[^@]+" 0; # allow Thunderbird autoconf
"~.+=.+" 1; # deny any other query
default 0; # allow (no parameters)
}


if ($bad_query = 1) { return 444; break; }