Could they write a small imap application that dumped the headers into simple json or what have you that we could then verify before submitting? I know it's not exactly user friendly, but it would make the people that care about security a lot happier.