The webmail module now uses beautiful soup to parse the message (even plain text ones as sometimes these actually contain HTML) and return outout with no <script> or 'src' attributes for img tags.
We might wan to replace the image src with a real image, so that they render
It might also be worth looking at placing the html in an iframe so that it is both scrollable independently of the window and also that might offer some script protection