Ah good, so it's not just me then

I suppose it's a simple enough matter to put the functionality in place, but I'm extremely paranoid about writing exploitable code.
The last thing you want is to get your domain spam-listed because you overlooked something.
I think the good thing about using well known and widely used scripts is that they've already had months/years to get hammered on... but then a custom script can have everything hard-coded and has the benefit of obscurity.

@ziycon:
Thanks, I'd be interested in having a look at it.
I've already got a referer whitelist function written along with a few different input validation funtions, but I'd be interested in seeing how you're implementing mail() since I haven't used it before.