Distinguish between admin commands and user-submitted commands

I see that in mailhandler_process_message the admin commands are just concatenated with the ones extracted from email.
I think I need slightly better control - such as
- not allowing submitted content to be promoted from email
I guess that can be handled making admin ones come after - and replace - user ones.
or, in my case
- allow default username to be set by admin ... but not by the semi-anon submitter.

Any ideas?