1. If you give them access to mail, they can use it for the purpose you mention. You might need to write your own addional code to your open source e-mail server to remove that BCC.
2. If you give them Internet access, they can do that. But you can block certain site in your proxy server.
3. Give them thin clients. Then they won't have a personal hard drive.