Rails doesn't escape text in text/plain outputs, since before Rails 4.
See https://github.com/rails/rails/pull/8235
<%= t '.header', :from_user => @from_user, :subject => @title %>
==
-<%= raw @text.to_text %>
+<%= @text.to_text %>
==
<%= t '.footer', :readurl => @readurl, :commenturl => @commenturl, :replyurl => @replyurl %>
-<%= raw t '.hi', :to_user => @to_user %>
+<%= t '.hi', :to_user => @to_user %>
-<%= raw t '.header', :from_user => @from_user, :subject => @title %>
+<%= t '.header', :from_user => @from_user, :subject => @title %>
==
-<%= raw @text.to_text %>
+<%= @text.to_text %>
==
<%= word_wrap(t '.footer_html', :readurl => @readurl, :replyurl => @replyurl) %>