Thanks for the concern. I'm well aware of the problems you mention. I was intending to sandbox users with Docker containers (hadn't really thought about rkt) to prevent the kinds of abuse you're concerned about. Docker comes with the handy benefit of making onboarding dead simple:
docker run zorro/zorro \
-v /data/user/mt4installer.exe:/install/mt4.exe:ro \
-v /data/user/zorrokey:/zorro/key.key:ro \
-p 1234:5900 -p 1235:80 -p 1236:21 \
-m 384m -c 1
For example (though in practice I'd do this through the JSON API rather than the command line).
