mailbox: go simpler for now, give up two-sender unlinkability of recipient