For the email question, one of the alternative course of actions to deal with the email would be to turn off HTML email, so that any further emails that may look suspicious, the urls can be looked at... Or something like that, of course only if the users are "power users", aka "leet cuntz"