[bug 912440] Clean the to val before using it

The STR are kind of ridiculous for this and I can't reproduce it without using Live HTTP Headers since the username autocomplete stuff prevents you from writing a message to a non-existent user.

I tested using the STR in the bug and also spent some time making sure the form continued to work correctly with normal use scenarios. Everything looked good to me.

Quick r?