An IBAN by itself is just an account number. A random person obviously can't take money out of another person's account. The fact that this is possible in the US is beyond insane. I wouldn't trust a bank(ing system?) that permitted this as far as I could throw it.

No bank in the SEPA-zone will give anyone unauthorized access based on just an account number.

There are things like SEPA Direct Debit (SDD) which are basicaly mini-contracts between a creditor and a debtor -- with the banks as intermediaries. These can be used, for instance, by your ISP to automagically take your dues out of your account. Either party can cancel just about as easily as well. With most banks, they can be set up in a few clicks. Many banks support limiting the amount (e.g. 50eur/month) on a per-SDD basis.