1. This all depends what they do. Meaning if they post the actual true link to the photo no there is no protection. If they post say the url to the photo meaning the actual script link then sure there is protection because your using the script.
2. Sure there is subscription capability to pay for different levels and you can define usergroups with different permissions.