You have to ask yourself, do I trust every person who is or may be registered at this site?
If not, narrow down a whitelist to allow only those you know and trust
Clickjacking — you know how to look this stuff up, if you don’t already know why worry.
Neat concept, but that tag causes as many problems as it solves. And I think you are begging to be exploited by enabling it on forums. I personally don’t use them for paying clients and would advise any clients against using them. For dabbling around like the OP’s example, sure, but I wouldn’t build an insurance claims system or e-commerce web site with those iframe tags. And most frameworks like ASP .Net, Drupal, Wordpress, etc., make them superfluous anyway.
Yeah I agree with both of you, and a +1 to hank's suggestion of a whitelist, but maybe not for specific people as to specific services with a fairly reputable stature (Google Drive, YouTube, imgur, Flickr).