Yeah, I'm pretty shocked that iframes work at all.

Spammers could very, very easily abuse this. Send a valid-looking e-mail, then swap out the iframe content with something spammy once they've all been delivered.