Yes, this can be done with either client or server validation. Of course server validation is more secure since it can't be turned off.
You know if you use Digital File Pro you can have them only upload the big image and automatically create the thumb and get around the need for validation in this case as well.