How can messaging be restricted?
To limit messaging to specific users, you can change the site:sendmessage capability for the authenticated user role from allow to not set, then create a new role with site:sendmessage allowed and assign this to selected users in the system context. See the Blogger role for a similar case, where blogging is limited to specific users.
Alternatively, you could create a "Cannot send messages" role with site:sendmessage set to 'prohibit' and then assign this role in the system context to anyone using messaging inappropriately.
How can messaging be disabled completely?
Messaging may be disabled site-wide by unchecking the messaging checkbox in 'Advanced features' in the Site administration.
When is a user considered offline?
By default, users are considered to be offline after 5 minutes of inactivity. This figure may be changed by an administrator in Site administration > Plugins > Blocks > Online users.