Feels pretty easy to mitigate against. If a user deselects "allow email sending", then you can just remove that as a possible tool-call so it becomes impossible.