Wouldn't a 422 be best here? A 409 suggests a conflict when attempting to update an existing resource, or possibly attempting to create the exact same resource, i.e. a duplicate request.

Typically a 422 is used for validation failure, and I'd say that's what this is.