Would you be requiring someone to put the token in the body of the message? That's seems a high onus on the sender. You might want to make the token part of your email address, perhaps with the plus syntax. Also, the decrementing counter seems pretty easy to spoof/abuse. I'd be inclined to just get another email address, and control who gets access to it. Finally, you can look into the many spam filtering services already available, which, when set as "pessimistic" as possible, will catch well over 90% of your spam.