With Elmah installed on our dev web server .. can we restrict who remotely accesses it? Even f we hardcode the username/passwords (hashed?) or is it only via IP?
You can secure this in your web.config (if you indeed want it accessible to anyone on the production site) See: How to secure Elmah.axd?
Obviously change your to the appropriate values