There are a couple of things you can do.
First:
Make sure that there is no "Source" toolbar item in the toolbar assigned for your users.

Second:
The user can select between the Basic Text Box and the Rich Text Editor. When the Basic Text Box is selected, there are options under the editor box for Text, HTML or Raw.
To prevent this you will have to change the .aspx for the page that displays the editor to something like this:
<dnn:TextEditor id="Message" runat="server" choosemode="false" defaultmode="Rich" />
This will prevent users from selecting the Basic Text Box option.

Any HTML tags entered in while in the Rich Edit mode will be encoded and displayed as such.

As a side note, I would like to see options for this, for any module that allows users other than the Administrator, in the module settings of that module.