The EJB Spec does not reccomend that that EJBs should not create threads, the spec says that EJBs must not create threads.
The argument the spec gives for this is so that the container can manage the runtime enviroment, your second point proves the need for this restriction.
Is there no way that you could use a message driven bean or possible a MBean for this?
The only way it can be done safely is too create a customization of the ejb container such that any interaction goes through the ejb container interceptor stack to correctly deal with the security, caching, passivation, synchronization, etc. behavior required. If you don't want this extra behavior, configure your own custom container with the interceptors that provide the semantics you want. Your not doing EJBs at that point.