PHP mail form is being abused
Your script is vulnerable to a header-splitting attack.  Due to the poor design of PHP's mail() function, it is actually quite easy to introduce that kind of security hole.

In summary, if…


any part of the mail headers consists of user-supplied input,
and you didn't make any effort to prohibit newlines or escape that input,


then you will have a program that can send mail to any recipient of the attacker's choice.

Validation problems

As @EmanuelePaolini points out, you do make an attempt to validate $_POST['email']:

$email = check_input($_POST['email'],"Email address is required.");
# …

if (!preg_match("/([\w\-]+\@[\w\-]+.[\w\-]+)/",$email))
{
    show_error("E-mail address is not valid.");
}


However, the regular expression is not anchored with ^ and $ at each end.  Therefore, the code confirms that $_POST['email'] contains an e-mail address, but it fails to enforce that it contains nothing but a single e-mail address.

On the other hand, the regular expression is also too strict: it rejects many valid characters that can legally appear in an e-mail address.  Read RFC 5322 Sec 3.4 for the specification, or this summary of the older RFC 822 standard.