Ya, if someone has javascript turned on, their information will not be validated, and you can get some nasty stuff put into your system. Google "email injections" and "php form validation".
As for your code, at a very quick glance it seemed like it should be working, so its very potentially a problem with your server. You should try out the phpmailer class (google it), and use it to send your mails using SMTP. Its fairly straightforward to use, and there are tutorials on the site. Your email is potentially getting blocked by junk mail filters.