1.  How can I prevent other users from posting content to my site via an account email?

we recommend that you set the "publish setting" in global parameters to "no" for the default.  This will prevent any spam that might get to an email address setup in the "account" sections from being shown on the front of the site.  If a user is trusted, they can be made a power user and can user the powertag of {state 1} to allow an email to be published immediately.  Also, a non-poweruser user who is trusted may also be changed to have their articles published immediately under the user section in the backend.  In this case, any email from this address to the account address will be published.