umm you can try the built in private messaging feature. I serisously suggest taking 15-20 minutes looking around your forum software, you'll find all sorts of stuff you've been asking and you can save your time
If you want to block the upload of attachments from their computer and only make them choose via http instead, you'll have to edit a template and remove the code.