Safely use CryptSignAndEncryptMessage?
If I understood correctly, this solution could be susceptible to an attack called surreptitious forwarding?


If CryptSignAndEncryptMessage is implemented in the naive way, then it would seem that it is vulnerable to a forwarding attack. Microsoft has not published the exact details (AFAIK), so it is difficult to tell for sure.


  Does this in turn mean, if I include the receiver in the signed data, I am not susceptible to this attack?


There is a published recommendation done by a few very respectable cryptographers. It is in Section 7 of On the Security of Joint Signature and Encryption, and is along similar lines to what you propose. Specifically, they recommend:


  
  Whenever encrypting something, include the identity of the sender $ID_S$ together
  with the encrypted message.
  Whenever signing something, include the identity of the receiver $ID_R$ together with
  the signed message.
  On the receiving side, whenever either the identity of the sender or of the receiver
  do not match what is expected, output $\bot$.