Safe net against http header injection in email reports as the string can contain user submitted content
(likely it's been escaped upstream but we rather ensure security)

also fixes #7358