It looks some characters that aren't part of a valid zip/postal code are making it through current input validation. Let's tighten this up to only allow characters that we expect would make up a zip/postal code.
See T262232 for context and examples of the issue.