I guess a link would be helpful! The form is at http://www.housesnz.co.nz/form09.html. I am trying to modify it so that when a visitor clicks on the Mortgage checkbox at the bottom, it adds another email address to the recepient list.
Security Focus put MSA FormMail attacks third in their list of the Top Attacks for the 1st Quarter of 2002. Even Matt no longer recommends his scripts. Although the most popular, they are buggy and insecure.
Your list of recipients should be set in the script itself. You will need to test the checkbox value and modify your list of recipients in the script (not at the client level). You need to first find a different (better) script, and second upload it to a post so we can help you modify it to suit your needs.
You may want to send a notice to your host then. Since the recipient list can be altered by users, the script can be used to send spam, threatening messages, etc. through the server that are usually untraceable except back to the site and/or host.