For 95% of cases, checking that a commit is not part of origin/<branch> (or maybe any <remote>/<branch>) is a good idea. Worth adding a flag to opt out of the protection, of course.
(Very tempting to also add a special specifier for unpushed commits for faster rewriting, but that's probably on the too lazy/too ambiguous side.)