Hi Aaron --
It's not possible to disable the download link at present (good to know there's demand for this as a future feature).
Bear in mind that everything in your map is accessible to anyone who has a basic understanding of web development and can use the browser console. Everything you gather from map users, including emails if you're asking for them, is viewable when your map connects to the API. Even if your template doesn't show emails, they're still in the data returned from the server. (Not true for some of the older maps like the Chicago bike share site, which is running on an older codebase where we had a different user model).
We're planning on building better handling for user info, making the user and her details separate to the info submitted to the map, so it stays private, and we welcome suggestions for features we should include.
Frank