Fix email validation security flaw

Email addresses are now normalized using Unicode NFKC before validation to prevent homoglyph characters (like U+FF20 FULLWIDTH COMMERCIAL AT) from bypassing the single @ symbol check. This closes a security issue where special characters could be converted to @ symbols later in processing, potentially splitting one email into multiple recipients.