Here is an useful introduction to some of the threats posed by the use of HTML emails, as well some of the simple, but effective measures to prevent such situations.

More: continued here