Salesforce users will sometimes incorrectly process email address changes for portal user contacts - instead of creating a new contact record, they will edit the existing contact and change the email address. To prevent this, we would like a validation rule on the email address so that it is no longer editable once that contact is an active portal user. Additionally, the checkbox for 'Active Portal User' should be locked down so that this validation rule cannot be bypassed.