The ability to send to all contacts from a campaign should be limited by a setting accessible by administrators, or only allowed to be sent by administrators.