It needs a minimal markup type that excludes external URLs and SCRIPT, OBJECT, IFRAME and EMBED tags. That should suit what most people want HTML email for whilst making it a PITA for those who know how to abuse it.
Wade.
"All around me are nothing but fakes Come with me on the biggest fake of all!"
-- Karsten M. Self [link|mailto:kmself@ix.netcom.com|kmself@ix.netcom.com] [link|http://kmself.ix.netcom.com/|[link|http://kmself.ix.netcom.com/|http://kmself.ix.netcom.com/]] What part of "gestalt" don't you understand?