This is really cool, but executing other people's javascript in a page makes me nervous. What sort of restrictions are in place to prevent malicious exploits?
There are definitely things you can do, and I'm aware of some annoying ones. I'll just manually delete them at this point. Any security conscious person would view it with noscript and just read the javascript ;)
A system to automatically hide dweets (for later manual review) after receiving a certain number of reports would likely solve the problem in the short term.