Can an evil contract fill users' ram with junk data?
I am confused because you are asking questions without distinguishing between users and contract deployers.
If your question implies a contract deployer, it is to use the RAM of the account that deployed the contract.
RAM is purchased and used by contract writer(deployer), and it is entirely the contract writer's fault that they are misused within their limits.
Of course, it would be nice to provide a way to make sure your network can respond to these mistakes.