The public/private key pair make up your "account" the public key is derived from the private key but the private key cannot be derived from the public. In order to post an event you must hold the private or nsec key so the client can "sign" the event or the protocol will not accept said event

If one only has the public or npub key all you can do with it is view the account details, you cannot sign events and therefore cannot change profile details, post, etc

So, in summary, no one can post with only the public npub key.