The site_content table is it. Once a resource is in there, it's in the tree (after things are refreshed).
Creating a new resource in Revolution is as simple s this:
$res = $modx->newObject('modResource', array(
'pagetitle' => 'MyPage',
'alias' => 'my-page',
'published' => '0',
));
$res->save();
So you could do it with a simple form and a snippet (or as Bruno17 suggests, formit2db) or a custom posthook for FormIt.
If I did that (and I'm not sure I would, even if the client wanted it), I would probably use NewsPublisher, which AFAIK is fairly secure with respect to embedded MODX tags.
Any time you have user input going directly to the DB and don't require a login, you're on pretty dangerous ground.
------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone:
http://bobsguides.com/modx.html