There’s also this setting, which should be an immediate help?
I personally don’t think Trust Level 0 users should be able to send PMs and you might argue Trust Level 1 is too generous too …