This sounds like what I implemented in Chadtech/mail. If messages come in with an id that doesnt correspond to a pending request, then it just gets ignored.
I didnt implement a timeout thing, so I guess as it currently exists my project could just build up a lot of pending requests that never get resolved. I wonder what kind of problems that leads to.