Patch potential command injection in hubot-scripts/package/src/scripts/email.coffee

This pull request resolves issue #903 by calling `child_process.execFile` and writing to `stdin` instead of calling `child_process.exec` and using pipes.

It also fixes a bug in the script (at least when tested on Debian Squeeze) where the From header in the email was being set incorrectly, leading to an extra recipient being added to every email.