Unless the user approves linking the outputs together. Sure, generally speaking it is a bad practice, because you reveal common ownership, but if you mix regularly and receive coins from a specific source, then consolidating toxic change with other toxic change might be acceptable by the user.
What should users do with their Whirlpool change since they can't spend it to anyone besides the source who originally sent them the coins in the first place?
The user chose to consolidate a dozen private coins into one. I agree it was a very bad practice, but it is not Whirlpool's fault.
It is Whirlpool's fault because Whirlpool doesn't allow you to consolidate your coins privately like WabiSabi enables.
Yes, do not allow the coordinator to accept creating outputs with the same addresses as the inputs. Why would Bob pay another input of the coinjoin?
Your solution would allow Bob to DoS the coinjoin coordinator by choosing an output address that matches one of the input addresses.
WabiSabi coinjoins literally have identifiable input and output merges, which I agree that they happen on multiple coinjoins that obscure the ownership, but reveal quite a lot of information. See
kycp.org/#about on input / output collaborations and merges.
What information was revealed from the 262 input collaborators and 294 output collaborators in this WabiSabi coinjoin?
https://kycp.org/#/710d395ca20709096a0778927cb960a466be675b188a234b9b52ffb88bb97a3e