This one now seems to be a bit of a nuisance, and not something I'd thought much about before.

The email for automatically generated emails (eg. registration verification) seems to come from the admin account for the Portal.

Now I don't like clients to have this access as they can make a mess with pages, modules, Portal settings etc.  But emails should be sent from their domain, so the Admin account email needs to be one of theirs. Doing this, they get access to passwords and therefore admin access to the Portal!

Is there a way around this?

I definitely agree it needs to have other options here just as you've suggested!

As you've said - it is an Administrator role that this has to come from, so it can be an issue since email is separate to a website and I have no control over a clients mail server and email accounts... so unless a different email address (domain) is used, I can't prevent a client from getting Administrator access to the Portal.