Perhaps doing a lookup of the domain the ip is in, and mailing to administrator@domain, or similar.
As IIS (which is the only thing Code Red affects) uses administrator as the superuser, it's unlikely root@ would get a valid email. Also, it's unlikely that each box would be running it's own mailserver..

Malk