Regarding the /email API, you could make it private rather than public. See this doc on how to manage permissions.

Regarding changing the to and from, I didn’t understand what are you trying to change ? (is it something mentioned on my blog?).

Also, for setting config variables, you could have a look at this doc to add configurations (lets you add custom configurations as well).

Another doc also suggests how to configure an email plugin which might be useful to you.