I think that the power of flooding is fun, and really wouldn't want to see it limited to knee high water or only 'true' floods in channels... but there should be certain limitations. One slight mistake or clever set-up shouldn't flood the entire fortress and outside world instantly.
A lot of people have suggested using some kind of Z-coord 'depth' sort of thing... the issue here is that it wouldn't be obvious to the player. I can't think of any easy way to convey such depth without massively complicating the display...
You know, here's a simple solution: Make it so water doesn't flood too far into tunnels that are only one square wide. It can be assumed that such tunnels are not 'deep' enough or something like that; it might wash far enough into a doorway or short hall to flood the room beyond, but it would be assumed that other narrow areas are designed to be floodproof.
Wierd though it might sound, I think that that would end up looking intuitive... Floods would have natural-seeming bounds, and with the ability to go a few squares into narrow tunnels they'd still be able to be a little dangerous.
Possibly there could be pumps to force water or lava into narrow tunnels for when the player wants to do so. Lava would doubtless require a steel pump at the very least.
I don't know what to do about flooding the outdoors, though. Realistically, what would happen if you let water out? It wouldn't explode out everywhere the way it does now... it would flow 'downstream' to the river, forming a new tributary.