The solution to the problem is to put the flags "user,noexec" in the /etc/fstab entries for USB disk-like devices. That way, users can mount them without being root (this saves you having to get up everytime someone brings in their camera full of holiday snaps which they want to show everyone), but they can't execute anything from there.

Or whatever the Windows equivalent is.