Reuven,
the (new) forums package can accept e-mail responses and post them to the forum. I haven't activated this feature myself and can't comment on the robustness of the implementation. However, I'm inclined to agreee with your security concerns.
Don't forget the need to extract only the meaningfull text from the e-mail response. This is particularly an issue for batched notifications which contain more than one post to which the receiver can respond.
See forum-reply-procs.tcl for the current qmail based response handling.
/Bart
