Messages from donor/volunteer default private

When a donor or volunteer sends a message on a donation with both, the
default is private to the student. (When the student sends a message,
the default is still to both.)
Validate recipients to close security hole

Otherwise someone could send a message to any random user on the site,
by passing arbitrary recipient IDs in here.