> Why does this need to be special-cased?

This makes sure a list is returned from the validator, even if only one element is selected. I was surprised that there's no easy to do that in formencode, but maybe I just didn't find it. For some reason I haven't inherited from `formencode.validators.Set`, but I don't remember why (shouldn't code when ill...)

> Doesn't that mean that I can send email to arbitrary members of any instances, as long as I select one instance at a time?

I don't understand how this should be possible, as the relevant check whether this is an allowed instance happens afterwards. Or do I oversee something?