Those are all good things, and generally follow general good practice. The most important thing you didn't mention is that you not allow the client to modify the subject/body of the e-mail, since this would allow them to send out their advertisements. Part of this should include making sure that the address provided is actually just an e-mail address (see
). A good tool there would be
. If you are more paranoid (like me), you could also include a
, those funny looking character jpegs.