It’s really easy to drop an unprotected mailto: address into your Web design, but the consequences can be severe.