This looks very much like a mail injection attack.
I don't know what your form prompts for, but let's imagine that it prompts for a recipent's email address. If your visitor types in "me@mydomain.com" your code ultimately triggers the following input to your sendmail program:
Which is fine, this tells sendmail that the mail recipient is as you expect.
But what if they type in (or otherwise send to your form) a value of "me@mydomain.com\nSomething else"? What might happen is that your code might pass that whole string on to your sendmail. That would mean that the following ends up being sent to sendmail:
The "Something else" bit is now interpreted by sendmail and rejected as invalid.
But what if "Something else" was replaced by some commands which sendmail would happily process?
Now your mail program has unwittingly sent out some spam to poor old joe@schmoe.com
Ok, so this is a simple example, but you get the point. A scripted atatck can stuff mail headers into your form handler, which might in turn pass them on to your sendmail program, unless you are smart enough to filter out the rubbish.
What values does your form accept. A safe system will always attempt to ensure that only expected inputs are allowed through. In this case a regular expression check could have been used to ensure that the incoming email address didn't have anything weird in it. You can find tons of useful examples of ways to validate email addresses if you look around.
If your form allows a free text area for your visitor to enter a message, that could be slightly harder to block, but you could always reject any input that has known suspicious-looking strings in it. For example, would any legitimate user try to send a message containing the text "Content-Type: multipart/mixed"?
Can you check your mail logs? Did this attack succeed? Did you actually send spam?
