Where are the messages being sent?

Based on what you're saying in 'message substitutions', you're accepting as input the 'who to send to' type fields -- unless this is a 'mail this article to a friend' or similar, you typically don't need to take that sort of input from the user, as it's dependant on the submission form.

In the case where we were hosting the script for users on the system, I had users create configuration files (which contained required fields, message formatting rules, recipients, response to the submitter, etc), and they passed enough information to the system for it to locate their configuration file (user name, and path from their home directory).

This way, we could allow users on the system to use the script, while rejecting it being used as a backend for unaffiliated persons. (and so long as users have write access to the system, it's much more effective than referrer ... you could probably pass in a URL to get the configuration file, and have an acceptable pattern, and cache, but it's going to be much more complicated)

If you're allowing visitors to specify the recipient (e-cards, mail this article, etc.), I'd probably use rate limiting by IP, and some more general rate monitoring (if I see a sudden spike in usage, it might be an issue, even if it's coming from multiple IP addresses). I might also do some sort of monitoring of 'added' body content, if it's acceptable by the security rules, so that I can see if the the same/similar message body is being repeated over and over again.