In it's' mail system, HTML is used to format mails, defining images, links, fonts and more, however HTML also enpowers abusers to do things that the system shouldn't allow, such as using img against log_out.aspx or index.aspx (does the same thing when GETed without arguments), or even /, I threrefore suggest that you create a special language, in which the number of structures/functions/possibilities are reduced, making it more difficult to abuse.