For example, if the form contains a command that sends anonymous Email then students can change a copy to execute any command instead. If the faculty's Email address is in the form, an abusive student could download a copy, change the address and so be able harass anybody on the Internet. So the feedback form could not contain the full address of the faculty member. Such abuse is harder if only an encrypted version of the faculty's address is on the page. However, this design would mean the developing an encryption scheme.
Risk analysis lead to the idea of minimizing the information put into the feedback form.
Two other risks had to be thought about. First, some means was needed to stop people abusing the service by creating an anonymous mailer. This would be an attractive target for unscrupulous Internet marketeers. A hacker once hijacked our Computer Science system to send mass unsolicited Email. Thus the faculty page can only create forms that deliver mail on campus.