If osm is restricted to simply storing and emailing of generated reports, then there should be no issues at all from using osm as it will be entirely passive. If you enable reactive measures (such as suspending accounts or disabling email from being sent by a particular user) then those actions should be taken into account when weighing the risks against the benefits of such measures.