You may be getting confused between an email address embedded in your form (such as a "mailto:" link, which can be easily read by a bot or any human who looks at your web page's source, and an address in your php handler, which generally can't be accessed. Of course, nothing is 100% secure, but...