Fix TargetEmail field, prevent address injection