Updated the test to check for at least 3 characters, thanks.

One issue still remains:

  "if ($mail_address)"  always returns true because
getDefaultFromAddress returns addresses enclosed between "<>", no 
matter the content of $addr.

   function getDefaultFromAddress($fullname = false)
     {
         $from_addr = '';

         if ($fullname) {
             $name = $this->getValue('fullname');
             if (!empty($name)) {
                 $from_addr = $name . ' ';
             }
         }

         $addr = $this->getValue('from_addr');
         if (empty($addr)) {
             $addr = Auth::getAuth();
         }

         return $from_addr . '<' . $addr . '>';
     }

I agree. Fixed in CVS and FW_3. Thanks!

When a user does no have a properly configured profile (from_addr 
field is missing), download notifications are sent to a null address.

attachment.php calls getDefaultFromAddress() de 
lib/Horde/Identity.php, wich returns Auth::GetAuth as email addr when 
from_addr is empty.

         $addr = $this->getValue('from_addr');
         if (empty($addr)) {
             $addr = Auth::getAuth();
         }

The problem (IMHO) with this is that Auth::getAuth returns an empty 
value, because attachment.php is called anonymously.

What do you think about inserting a check before the message is sent?, 
just after this line in attachment.php:

$mail_address = $mail_identity->getDefaultFromAddress(true);