No. He can't. I'm pretty sure there's a post around that explain why this is not possible.
Correct, unless he wants to severely hinder the servers.
The client can save with zero interaction with the server as it is now. (with exception of ownership and events)
In order to make it 'admin only' or 'passworded', it would have to communicate with the server, meaning the client saving would have to be removed. This means the server would have to load up a bunch of info and transmit it all to the client, which not only would put more processing on the server when it's getting the info, but also killing the bandwidth when it's sending all that data. It would take longer than ghosting and have a much heavier affect. Think of the time it takes to upload a save, but backwards, and the data isn't already there.
And even after all this, it would be possible for someone to write their own saving script to bypass it.