There is no email validation

Users can enter any random string for the email address and the module appears to attempt to email using that string.

This can be a security issue (since the from address is inserted as is into the message headers).

Attempting to subscribe an address like:

joe@example.org\r\nSubject: buy viagra here\r\nTo: thirdparty@example.org

Could cause the script to do things it wasn't intended to do.