This code is exploitable. Somebody can add header information to the Subject field to send email to anybody they wish.