I have the same behaviour with an application wich stores Word document as OLE object in a rich text item on a notes document.
The ECL alert you are receiving comes with the fact that an external application is trying to do something with your database.
I have signed all documents (I mean the Notes documents) but it does not change anything.
I do not have any other solution to let users to choose to trust this unknown user to do something. In a matter of facts, I do not have anything to prevent them doing this...
And everytime the ECL is changed, they have to do it again.
Hope to find something better. One day...