Thanks for all of the feedback! There is far to much to respond to individually here, but I'll address some of the more salient points and consider the rest carefully.
Regarding consistency of wording on the site and in emails, it certainly isn't perfect. We may lighten up on the catapult terminology to avoid confusion. There were a lot of other good suggestions we'll take into account.
On confirmations, the transaction server waits until there are enough funds in the account with 2 confirmations to allow sending. It may not be the exact funds you sent. It may be part of the buffer we keep in there to avoid delays. It may be older funds that have simply been sitting. In this way, there is a 1:1 relationship between incoming and outgoing funds, but access is maximized. This also makes Coinapult a very basic mixer.
On email security, this is an issue. Email is almost always insecure. I can allow PGP mail, with modest effort, but only a small percentage of people would be able to use it. I'm open to suggestions on how to improve the email security, but the goal of Coinapult is usability. As has been noted, those who are ultra security conscious, or have need to move large amounts of funds, have other means of doing so. bitaddress.org and an encrypted email is one reasonable solution. Try getting grandma to open it, though.
Last, on this subject, DKIM is a great idea.
