D*H is also an IT guy and his mom calls with computer questions all the time. He finally had her bring her computer here for an overhaul and found nearly 400 malicious hoo-hahs on it. The woman clicks on everything. And she's got grandkids who use her computer to visit, let's just say sites that aren't especially into user security.
He set her up with some antiviral stuff, but like your bosses, she's still allowing all sorts of video and attachments and whatever. He actually threatened her with not taking her calls anymore if she keeps doing it.
I think ground rules are most appropriate. As a self-employed person myself, I know I don't have regular office hours. If I had an employee, I might need them at 7am on a Sunday, and without anything telling me not to, I might be tempted to call if I've got a history of off-hours calling.
I might suggest a troubleshooting education poster, too, to put up near your bosses' computers. "If the error message reads..., do this..." kind of stuff.
Good luck.
Roxy