I am also worried about how to prevent spam and as well as that, to prevent people assuming others identity.

I want email users to post with username in the same way, now this will just be taken from their return email address but of course this can be fourged so the only thing i can think of it somehow having their password in there as well, is there really any other option? I certainly don't want an email subscriber being able to send a post that say appears to be from an admin because they forged their email address into the headers.