Is Craft's Email Service Protected Against Mail Header Injection Attacks?
Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks


Yes.

Attacks like this, for the most part, are really only a concern for PHP apps that roll with their own custom email logic instead of using a widely used/tested email library.  Craft 2 uses PHPMailer and Craft 3 uses SwiftMailer.

And they both provide methods for stripping out newlines to prevent header injection attacks.