blank mails (drupal.org security announcement)

I have received two blank "security announcement" emails in the last 24 hours (both to the same email). Whatever is going on, the process seems to be repeating itself. There has only been one new security announcement recently, and I don't usually receive duplicate emails from Drupal.org.

Two version of the security announcement have been send, one for CCK 5.x-1.8 and one for 5.x-1.9. That explains the two mails.

I don't have many clues. One observation however: Both the node title and node body have been cleared. The email title was '[Security announcements]' instead of '[Security announcements] SA-2008-048-b - CCK - Cross site scripting' This means that the fault is prior to line 1026 $node = theme('simplenews_newsletter', $node, $tid); and that both node->body and node->title were affected.

Blank email have been reported before, but no clear cause or solution has been reported:
#55956: Every cron run sends out new blank email
#39397: SimpleNews sends multiple blank e-mails among properly formatted versions
There has been suggestions that blank emails can be caused by access restrictions, perhaps unpublishing of the newsletter node. Newsletters are send by cron and cron is anonymous user. On my test site unpublished nodes are sent using cron without problems.

We ran some tests on Drupal.org and it appears that node_load sometimes fails to load a node. When this happens at the beginning of the simplenews cron run, all the mails send during that cron run are empty.

The workaround we want to deploy on d.o. is similar to the attached patch.

Committed with an extra watchdog message.