html is allowed in the message body
why not just include a script that'll hijack their browser or something.
i remember for some older versions of that kinda forum thing, i added <BLINK><FONT FACE="Wingdings" COLOR="BLACK"> to the message subject and the message body and it turned their entire forum into blinking wingdings...
pretty annoying, still works on a bunch of sites that use similar forums.. those free forum thingies are pretty fun