Although I assume we could get an account suspended if it started opening spam issues, yes we default to letting anyone open issues, and potentially abusing it. That much is the right default and I don't see any policy tweak that stops that.
I'm accustomed to Closed being a final state that nobody can reopen as a matter of workflow -- the idea being that anything else should be a new discussion if the current issue was deemed formally done.
Spark pretty much leaves all issues in "Resolved" status which can still be reopened, and I think that's right. Although I'd like to limit all reopening to committers, it isn't that important.
Being able to move a JIRA to Closed permanently seems useful, as it doesn't interfere with any normal workflow, doesn't actually prevent a new issue from succeeding it in normal usage, and gives another tool to limit a specific kind of abuse.
It can stop reopening, but new JIRA issues with duplicate content will be created intentionally instead.
Is that policy (privileged reopening) used in other Apache communities for that purpose?