As of the build going out now, is no longer possible to set page sizes outside 15, 30, and 50 (1-50 was valid before). The page sizes are validated before going into your user preferences and on the way out for anyone already affected/stored with an invalid value. Given the default page size is 15, the most a malicious user can do is change it between the 3 valid values (greatly lowering the appeal of such an attack).
It's not a perfect solution, but it gets most of the way there without making simple paging far more complicated. We have some ideas of how to better solve this long-term (e.g. maintain the status quo for fetching a page but beacon API the page setting...but such approaches are fundamentally more complicated and more error prone. I'm not sure such potential issues are worth the tradeoffs.
I'm very curious on thoughts though - comments here would help on next steps. I'm calling this status-completed as the annoying pagesize=1 attack is no more.