Since you can insert arbitrary JS, it feels like you could write a loop that ajax posts a bunch of new webspaces when someone visits a webspace. Might look into protecting againt that.
Is there a list of pages people have made?
So with out src & href you can't have links, seem like a massive limitation. Was trying to a submit a personal site with external links, guess it's no use now.