Wasn't this a problem years ago?
I distinctly remember removing the prieview pane from Outlook 98 and disabling VBA to prevent this sort of nonsense.
Does it hit with webmail or only mail clients?
That said, I need to check that JavaScript is disabled in my e-mail client. . .