Custom form, webform, or entityform
The best and quick way to go with is using EntityForm. The module provides advantage of using field using which you can have Entity/User Reference fields with auto-complete, without writing a single line of code. To notify 3 users on Email, you can use Rules Module. And the other advantage is, it is maintained by Community so all security issues are tracked and fixed before the site can get affected.

Webform module doesn't support auto-complete by default you'll need to use Webform Autocomplete module for that. I've not used this module, so not sure if this provides the option for referencing existing entity.

If you're building it custom, you'll need to build everything by your own using Form API and Mail System. Which will be time consuming as compared to using EntityForm.