I don't know if it's a security hole or what, but I think the option you want to set in the usergroup manager is "Can Email Members" in the General Permissions section. "Can Use Email to Friend" has to do with the "Email this page" link, according to the help for that option.
If you still have the problem you might try looking at your web server logs. If someone's using a security hole to spam all users, it seems like it should be easy to spot.
|