What can stop a user from manually typing in a function name in URL?

[eluser]predat0r[/eluser]
Store the user_id in the post. And check if the logged in user_id is the same as the post's user_id. I guess you use authentication