Of course the only ultimate solution to "replace bad vendor query" is "replace bad vendor." 😀

You can set up a trace with a high threshold(s) to capture really bad queries. Then try to track back to where they came from 🙁 ... won't be easy, but don't know what else you could do.