The motivation for this question is roughly along the lines of a puzzle contract -- whoever submits the correct solution to the puzzle gets a reward from the contract.
I'm guessing that the 'thing' in a transaction that is actually signed is a hash of the
to: addresses (the sender and recipient addresses of the transaction in question), and
value too.. This would prevent malicious miners from just changing all
to: addresses to ones owned by themselves, and mining blocks transferring random people's money to them.
data field included in the hash too? Is it also sent in the clear? Is there anything 'binding' the signature/original sender and the data together? If not, is there anything else preventing puzzle solutions submitted to the contract being intercepted and resubmitted by the lucky guy mining the block?