Simple and useful. Excellent work! If you feel the need to mitigate potential abuse, you could first send a verification email for any new recipient-email (or sender-ip / email combo) -- requiring active opt-in from the recipient. Personally I wouldn't bother unless it becomes an issue :)
I tried both flask-restless and restful as well, but like you have moved away from them to a simpler setup. Just using a simple flask app + blueprints with a few extra error handling / cors bits and a custom response class for json. I'm very happy with marshmallow too.