When cases are emailed into FogBugz, the case has a "ticketurl" which provides access to just the case's status and any email activity in it. It also lets the correspondent view the status of any other cases sent from the same email address (you can also prevent this access).
To show someone ALL cases in a project. You can use the Community Case List plugin.
The plugin provides access to the same type of status information as the ticketurl, but for all cases within a project, subject to the permissions you set.
Go to Admin -> Site -> Authentication tab and make sure community users are turned on. You can set there whether only admins can add accounts, or community users can self-register. If you choose the latter, the new users don't get permissions in any groups by default, so that's not a security hole for the case status page.
Set your permissions for the project by either individually adding users and email domains, or by putting your users into groups and giving them permissions on the project.
Get the Community Case List plugin from the FogBugz Plugin Gallery.
The plugin doesn't change the non-logged-in screen at all (what anonymous visitors see). The public project(s) will let anyone enter a new case from there, but not see anything. When a community user logs in, they get to see cases according to the permissions setup above. Even if it's public, a project can't have permissions set to allow all community users to access it (like wikis can) because fogbugz doesn't let community users see cases. This means you can't accidentally open up a whole project; You have to specify community user permissions per user or with domain wildcards in the group settings.
The plugin's page, itself is like the status page a user gets from the ticketurl when they email a case in. It doesn't show internal edits, just basic status and email history. Again, this means it is hard to accidentally leak sensitive info. If you want to show more info, you could write your own plugin instead of using this one. Plugins by default have the access of the user who is logged in, but you can override if you wish in the code.