"You still send input from the form to an email address that also comes from the form"... How else can someone tell their friend about my site through my site?!

By sending an email message that consists of just fixed content. You were doing fine until you decided to include the contents of $message - which could contain anything.

"The first rule of Perl club is you do not talk about Perl club."
-- Chip Salzenberg