Email headers (To, From, Subject) must be sanitised but the email body can be left as is.