This is not really answering your question, but I noticed you just blindly use the user's input. Never trust your users! ;-) What if I craft my POST or GET request so that the recipient variable looks something like:

recip1@doma.in\nBcc: recip2@doma.in, recip3@doma.in, recip4@doma.in
[download]

Please run some tests over the values you receive, before spitting them to a mail process.

Spammers will love your script ;-)