How can I prevent users from inputting URLs into a field?
The Field validation module let you set up your own regexp or PHP code to validate (or not) what user puts into a text field.  However to reject e-mail addresses, your validator must be clever enough to not only recognize regular e-mail addresses such as spammer@example.com but also obfuscated e-mail adresses such as spammer(at)example.com.

Added note (about filtering): If, instead of rejecting input that do not validate, you want it filtered by having email addresses and links removed (or replaced with some string indicating redaction), you can use the Plain text input filter as a starting point, and just replace the code that currently turns email-adresses and URLs into live links, with code that redacts these things instead.  Then, just rename the result of hacking the code, and add it to your configuration as a custom filter.