Do I need to sanitize a user input textfield used in a mail body? I have a feature on my site where a user is allowed to edit a textfield is a Drupal form (built using the D7 Form API) and then send the contents of that textfield as (part of) the body of an email to another user.  I use drupal_mail to send the mail.

The textfield is saved in the database, and I rely on the Form API to protect against SQL injection.  The textfield is never rendered on the screen outside the textfield widget, so "dangerous" HTML tags and PHP/JavaScript injection is not a concern (I hope).

I use DefaultMailSystem as mail backend.

Given that the user can type anything in this textfield, is there any need to sanitize this user input before it is included in the email body and sent?
There are two reasons to use Drupal's text filtering system: security and proper formatting of the information for the context. 

In reverse order:


For formatting: if you use something like the markdown filter or limit with html tags can be used for simple sanity (i.e. no h1) then you want to use a filter that removes that.
For security: you want to remove malicious code if it is being displayed in an environment where that matters. In the case of email, the relevant DOM is the email client which can sometimes be a domain. However, if it is a security weakness to that email user to get javascript...that is a problem with their client. Since anyone can send any email to any address with any (malformed) contents it is not a major consideration of e-mail processing to ensure the body is "safe" (without scripts). See this discussion on g.d.o/security about sanitizing text in email bodies


That said, you don't want your system to be useful for spam. 


Consider using the flood_control system.
Consider adding an introduction and closure to your email message to make it less useful for a spammer. For example "This email was sent from example.com. Your friend said: _stuff_here_. If you have questions contact your friend and not example.com"


There is more to e-mail than the body, of course. E-mail headers can be a vector for attacks, since someone can use a newline as part of the "to" address and then append new headers to send as many mails as they want to whomever they want, pretending to be from whoever they want, hurting your domain's reputation in the process.

One other side-note:


  The textfield is saved in the database, and I rely on the Form API to
  protect against SQL injection.


SQL Injection protection should come from proper use of methods and arguments in your db_insert or db_query function. It does not come from the Form API.