As for making sure that the recipient can't be changed after the fact, shouldn't the whole message not be editable after the fact by the user? In that case, we simply just don't allow functionality to edit messages (since we'd have to explicitly build that feature anyway)