I think the question here is:
"How do I get exactly what I want from
my users by making input absurdly easy
for them"
The only instance where I see users actually needing to use HTML directly in some form of input is when / if they are formatting tabular data. However, in that case, its much easier to give them a form that can do the same, or any one of the popular grids available in various libraries.
I think the golden rule, at least for me is, use a system of markup that is not HTML, which your form handlers can then use to construct beautiful, standards compliant and semantically correct HTML.
Third party scanners can (normally) detect most problems with uploaded files. I personally like ClamAV - which is available for both *nix and Windows.
That solves the problem of making sure everything is arranged nicely, formatted correctly and no undesirable stuff is being served to visitors, or is it?
The other thing you need to do is review any content that they submit, a human being has to have some part in this or stuff is going to be missed. Is that image appropriate? Does that link lead to malware or something else that you would rather not link to? Etc.
Providing a flagging mechanism helps, but is always not effective. For instance, if you provide an answer to a two year old question on stackoverflow.com, the question is immediately bumped to the front page where the community is sure to review what was just added. Not all systems are designed with that sort of safeguard in mind.
If you do a significant amount of volume when it comes to user contributed content, its probably worth your time to explore using contractors who simply review submissions to make sure inappropriate media / links are weeded out quickly. Or, perhaps you can enlist help from your community of users (if one exists) to do the same, in exchange for some kind of special privileges or extra perks that normal users don't enjoy.
correct
answer.