I smell XSS.
What happens if your message is `<h1>This is my message</h1>`, and your E-Mail Client is fine with HTML by default (AFAIK most webmail-services).