Email addresses in mailto: links do not need special characters like the @ escaped in the HTML.
mailto: links that specify a subject, body, etc. do need those values escaped, see e.g. here.
Email addresses in URLs do need to be escaped, one way to do that has already been shown above.
Comment on Re^2: Post Email address as CGI Parameter
Even more specific: mailto's are specified in RFC 6068 with some definitions coming from RFC 5322. Those specify the exact rules, a little complicated to summarize here, but for example the @ between the local-part and domain in the addresses shouldn't be escaped. The URI module claims to support the now obsolute mailto specification from RFC 2368.