But the problem with this approach is that the rules we want to enforce will be skipped, if I forget to call the magic save method (read:  follow normal ActiveRecord practices).

I do agree the hook should not send the email.  Really, the model shouldn't either, in my opinion.  The controller should send the email, I think.