Based on discussion with Earl so far, I think the correct fix is disabling HTML mail support by default.
- Bug#607693: mhonarc: cross-site scripting when converting... non customers
- Bug#607693: mhonarc: cross-site scripting when conve... Jeff Breidenbach
- Bug#607693: mhonarc: cross-site scripting when c... Jeff Breidenbach