On most nets, following regex (i know its not perfect) does a good job filtering invalid inputs.
It checks full usermasks (like $fulladdress) including wildcards (remove the three * if you dont want wildcards), and returns true if the mask contains only valid chars:
$regex(%fulladdresshere,^[-\]\\_*^[{}|`\w]+![\w.*~-]+@[\w.*-]+$)