How can I set a maximum allowed post size and number of posts submitted?

The best way I know of would be to filter the data.

For posts, you might do:

function my_check_post_not_crazy( $data, $post_arr ) {
    $max_content_length = 2048;   # max length in characters
    $max_num_posts = 200;         # maximum number of posts

    if ( !current_user_can('activate_plugins') && empty( $post_arr['ID'] ) ) {
        $die_args = array('back_link' => true);
        # Not an admin user and trying to add another post of some type
        if ( strlen($data['post_content']) > $max_content_length ) {
            # Too long
            wp_die("{$max_content_length} characters maximum", 'Cannot Post', $die_args);
        }

        $args = array( 
            'author' => $data['post_author'],
            'posts_per_page' => 1
        );
        $posts = new WP_Query( $args );
        if ( $posts->found_posts >= $max_per_user ) {
            wp_die("{$max_num_posts} per user. Limit Reached.", 'Cannot Post', $die_args );
        }
    }
}
add_filter('wp_insert_post_data', 'my_check_post_not_crazy', 10, 2 );

The same idea works for attachments using the wp_insert_attachment_data filter.

I just realized a couple of things looking at this again:

  1. Rather than stop them from posting a new post, it would be more user friendly to prevent them from trying in the first place. Maybe there is a hook to check and see if they can post, grab their current post count, and then give a message right when they click “New Post”.
  2. Rather than setting back_link to true when they have exceeded their post length, it would be more user friendly to set it to false and tell them to hit the back button. I think that will ensure they still have their new text in the editor so they can adjust it. Another option would be to use javascript to track the length of the post and alert/abort with an error if they try to save/publish when there is too much content.