The mail gateway currently does not check the appropriate 
permissions for the following actions:

1. Creating an item (e.g., an issue)
2. Creating a file
3. Creating a message
4. Adding a file or message to an issue
5. Editing any property of a class

I've attached a patch which checks all these permissions.  The 
patch is against the CVS head.