My suggestion would be to modify the following variable in the server.properties file:
spawn-protection=999999
Then OP yourself and anyone else you trust to place and destroy blocks. This forces your world (or at least any realistic distance from spawn) to have spawn protection. Blocks cannot be placed or destroyed in this area, unless you're an OP (and at least one OP must be listed in order for it to work).
Note that it is currently not possible to fully prevent the griefing you described above in vanilla without tampering with the user's inventory or use of modding tools.
As of Minecraft 1.8 and the upcoming 1.9 (currently snapshot 15w43c), there is no way to do this in vanilla Minecraft, short of a customized command for every single player.
It would require the use of placeholders/variables in NBT data, for which there is just no way.
That said, if the list of player usernames is known and fixed, you could use one command per player, executing only if that player is the one closest to the execution point.
/execute @p ~ ~ ~ execute @p[name=Alice,r=0] ~ ~ ~ summon ArmorStand ~ ~ ~ {Equipment:[{},{},{},{},{id:"skull",Damage:3,tag:{SkullOwner:"Alice"}}]}
/execute @p ~ ~ ~ execute @p[name=Bob,r=0] ~ ~ ~ summon ArmorStand ~ ~ ~ {Equipment:[{},{},{},{},{id:"skull",Damage:3,tag:{SkullOwner:"Bob"}}]}
...
/execute @p ~ ~ ~ execute @p[name=Zuul,r=0] ~ ~ ~ summon ArmorStand ~ ~ ~ {Equipment:[{},{},{},{},{id:"skull",Damage:3,tag:{SkullOwner:"Zuul"}}]}
Best Answer
To stop players breaking them, make the ArmorStand invulnerable:
To prevent players from taking the items on the ArmorStand, use the DisabledSlots tag: