SQLite have a bunch of features that would allow limiting what you can do in a request, and if you limit the access to a database by the user that puts e-mails in that database this is easily doable.

I started looking at implementing that