How is that working at all?
Since you're building a scalar ($cmd) that is getting interpolated before getting called by system, the message and subject are not literals (they're interpolated as well)
What happens when $msg is this:

$msg = '"|touch file_i_shouldnt_be_allowed_to_create|"';
[download]

I imagine it's at least part of the source of your troubles (and highly dangerous from a security standpoint).