bot.mail: sanitize user input with stricter regexp