http://forum.yetanotherforum.net/yaf_im_email.aspx?u=XXX  (btw, already disabled that feature and my suggestion to do that by default)

I tried both methods you describe against this forum and I get "Access Denied - You tried to access a page that is forbidden" - that means that the method you describe does not allow 'spamming' in the manner you explained. The closest thing I got was by being 'logged in' to these forums and using a user ID against the yaf_pmessage.aspx - but again - that user had to be logged in to do it - and in all reality, that's not a security hole... So if you are having issue here, you need to restrict your 'Is Start' role to not being able to send PMs until you verify the account. That's why most forum softwares allow option of new users not having ability to send PMs or emails until they've hit a certain post count -- spammers will get blocked within their first 10 posts on a forum (if not less) - so the possibility of users configured that way being able to spam the yaf_pmessage.aspx file would only be if you allow 'untrusted' members ability to send PMs or Emails...

Well, I think would be more user friendly to create PM sending frequency (for exam allow to send 1 message per 10 min). Or 10 msg per day to different users.

Manually approving absolutely can not prevent from spammers. If a forum has a few thousand users the spammer can make provide a fake activity as a usual user. Аfter he obtain an approval, he will make a spam in a short time.

I'm afraid but not. Yaf limits total count (which is looks like absolutely useless), but spam protection requires frequency.

Another one bug. I disabled PM feature on my board, and it disabled everything - history, contacts, sending.