I have a website where a user can send out emails from. I have kind of mimics basic form with:
To:
Subject:
Attachments:
I'd make 'send to all' just a checkbox, and the server determines that list (so it's not displayed client side).
With specific users, I'd allow the person who choose ID's from a list (not actual email addresses). If it's not mail client, you probably shouldn't be listen these peoples' emails publically. How you present this depends on how many people are in your database, etc. But autocomplete may be nice, or a simple tree-based selection. (Listing groups > people).