Posterous could offer a really simple, and optional, security option by disabling auto-posting unless your email includes a secret key. E.g. you would have to write 'passkey=tomato' somewhere in your email.

If the email doesn't include the passkey, the user would receive a "click link to publish" email.

Simple.