Basically, no email message should need JavaScript. So, I have that disabled and EXE and other "runnable" attachments. HTML is no biggie if all those things are disabled. I think if you get the latest patches for Outlook or Outlook Express, it does it by default.
As for Bat mail, its nice...