I am looking at PHPFormGenerator as an alternative to NMSFormMail because it generates the form and it can use captcha.

All over lunarforums they seem to recommend NMS because it does a great job at preventing SPAM injection. And I like the feature where the email has what the user specified as their email address becomes the return address so it is easy to reply.

Although the captcha is a barricade to bots, making sure that if it is overcame the form still won't send to any outside addresses seems important.

I can handle the modification to the PHP scripts where they use the mail function to add the return address but is it safe?

Is there another function/script to make sure the return address can't be exploited?