Hi James,
Trying to decipher their messages:

For 'new deposit':
- should anyone who can log into your repository be able to create an item, or is there a subset of LDAP users who would be able to authenticate, but not create items (e.g. undergraduates)?

If so, you might want to look at the usertype that gets assigned for these groups. There is (or used to be) a 'minuser' usertype – that could do some things, but not create new items. This might be similar to what they mean.
As far as I can see, I just get a 401 response if I try to get to that page – but I'm an 'unprivileged' user rather than a 'low privileged' one.

It's possible the same applies for the second URL – but again that gives me a 401.

In these scenarios, it might be useful to get their actual report – or if this is not forthcoming, try and identify the scan through the weblogs – so you can see if e.g. they were logged in when running the scan.

In general, EPrints does have function level access control – see my first response to Yuri this week – about privileges and roles.

Cheers,

John