I read a while back (somewhere!) about what msdb stored procedures to restrict to prevent users from
a) Creating or modifying packages
b) Viewing (seeing a list of) packages)
I can take some pot guess and spend hours doing it, but can any point out the exec privs for some of the sp_enum procedures in msdb that you would recommend to set.
Author of "SQL Server Backup, Recovery & Troubleshooting"
Author of "SQL Server 2k for the Oracle DBA"