Note HTML is not sanitized from text/plain content

When handling incoming messages, I think it would be good to note that the fields providing content from the plain/text portion of the message body do not sanitize HTML tags.