Hi, maybe I sounded a bit strict.
I am thinking about adding custom capabilities. That would make it easier to customize acces to functionality.
Currently the upload uses a standard WordPress capability. With a plugin like User Role Editor, you can add that capability to users with the role of Subscribers. However, this would make the whole media library be available to them.
With a custom capability this should be only for the media upload in the guestbook.
Even then, you want to keep a tight leash on your users on what they upload.