Could you please explain how checking for 'valid email address characters' (I take it you refer to RFC822) can prevent your box to become a spam relay?

Even if you do check, your box could be used as a spam relay, but at least you know the email addresses are 'valid' accoring to the RFC822. Preventing the user to specify the recipient of the email at all seems a better approach to me.