A paranoid solution to your problem.

Step 1: it's not what you reject, it's what you allow in. Rather than rejecting newlines, you should have a list of acceptable characters. Anything outside that list is converted to whitespace or escaped with %-notation or something.

Step 2: if you only want to support email to a small list of email addresses, then hardcode those in your script on the server side. If the web form mentions any address that's not in your list, ignore the user input and send it to a default address.