htmlspecialchars() only needs to be run for legacy reasons. I think that unparse() should return the original text. Going forward, it would make more sense to remove htmlspecialchars() altogether, let decode_message() return some plain text and let it be escaped by whatever function actually outputs it.