Only users can use form, list spam posts for admin

I would prefer to see this logic accessed through the controller, and particularly as a scope on the model