I agree with the recommendation for Email::Valid. The issue with your code seems straightforward: there's never any assignment to $1 or $2. Those should be "captured" by parenthesized groups in your regex. You may also want to trim or anchor the expression to ensure you're not clipping out an improper subset of the offered string.

if ($tainted =~ / ^              # don't start mid-string
                  \s*            # skip any leading space
                  (\w{3}[\w.]*)  # prefix to $1
                  \@
                  ([\w.]+)       # hostname to $2
                  \s*            # skip any trailing space
                  $ /x)          # don't end mid-string
    { $untainted = "$1\@$2"; }
[download]

--
[ e d @ h a l l e y . c c ]