Undefined index notice when node creation option hidden

This is the original error:

Notice: Undefined index: nodecc in mass_contact_mail_page_submit() (line 437 of /var/www/.../mass_contact.page.inc.

I was able to track it down to around line 360 of mass_contact.page.inc. On the surface, this looks wrong (the same code is duplicated right above):

$form['nodecc'] = array(
    '#type' => 'hidden',
    '#default_value' => variable_get('mass_contact_nodecc_d', 1),
);                                                                                
$form['nodecc'] = array(                                                            
    '#type' => 'item',                                                                
    '#title' => t('Archive a copy of this message on this website'),                  
    '#markup' => t('A copy of this message will !not be archived on this website.', 
                              array('!not' => variable_get('mass_contact_nodecc_d', 1) ? '' : 'not')),                   
);                                                                            

The second $form['nodecc'] overwrites the first one. I got rid of the notice by removing the second assignment.

But... if it did work, it looks to me like it would allow an unprivileged user to 'view source' on the page, and modify the form to create a node? The permission check should prevent the creation of the node somewhere along that code path, not just prevent the output of some HTML that a sneaky user could easily generate himself.