Specifically, who can unpost - I'm guessing that if you have Post security, you can unpost. We just don't know if you have Approve or Create Journal, can you unpost? Basically, they want to disable the Unpost functionality.
Sam is correct, if you are a part of the Journal post group, you can also unpost. Admins can always unpost as well. If you want to prevent this, a journal event handler rule would need to be created to block an unpost event based on certain conditions.