Wouldn't it be better to encode the mail body using base64 or quoted printable? That way you don't need to worry about what's in the body at all.

In general, if you can't strictly validate input (i.e. match it against known-good data), it's better to make the process completely indifferent to the input. In the same way that using placeholders with DBI is better than grepping on (un)safe characters.