About >50% computing power. As I know there were times when biggest pools did more than 5 consequtive blocks - 6 blocks are enough to add transfers of money that did not initiate transactions (not talking about double spending, but about unauthourised transactions in system).
No, you can't simply
spend coins unauthorized.
That's not possible.
Without providing the signature or more generally, the unlocking script together with its parameters, an output can not be spent.
I mean.. anyone could create a block which spends such an output without being authorized.. but this block would be invalid and therefore not accepted by every other node. Regardless of whether they have more than 50% hash power or not.
They would fork away from bitcoin and no one would care.