The documentation for PHPFormMail (borrowed from the Perl version) says If you want to require an email address with valid syntax, add this field name to the 'required' field. When I do this and use an e-mail field that is not valid, this is not detected. I've looked at the code of 1.07.2 and I can't see anywhere where this checking is taking place.

One fix would be to replace this text by text suggesting that the provider of the form provides a hidden field called mail_regex. The documentation should provide an appropriate setting of this variable. (There are plenty of suggests for this on the web!)