Out of curiosity, how are you preventing spoofed email spam? It looks like you're accepting everything to one generic email address, and posting via the senders address?