diff --git a/server/public/model/utils.go b/server/public/model/utils.go
index 7ae5f5eff8..662c6ada72 100644
--- a/server/public/model/utils.go
+++ b/server/public/model/utils.go
@@ -631,6 +631,12 @@ func IsValidEmail(email string) bool {
 		return false
 	}
 
+	// mail.ParseAddress accepts quoted strings for the address
+	// which can lead to sending to the wrong email address
+	// check for multiple '@' symbols and invalidate
+	if strings.Count(email, "@") > 1 {
+		return false
+	}
 	return true
 }
 
diff --git a/server/public/model/utils_test.go b/server/public/model/utils_test.go
index 1c1b1cd986..9608d4d921 100644
--- a/server/public/model/utils_test.go
+++ b/server/public/model/utils_test.go
@@ -396,6 +396,50 @@ func TestIsValidEmail(t *testing.T) {
 			Input:    "email1@domain.com, email2@domain.com",
 			Expected: false,
 		},
+		{
+			Input:    "\"attacker@attacker.com,admin\"@spaceship.com",
+			Expected: false,
+		},
+		{
+			Input:    "(email)@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "<email>@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "[email]@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "{email}@domain.com",
+			Expected: true,
+		},
+		{
+			Input:    "first\"name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "first:name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "first;name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "first,name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "first@name@domain.com",
+			Expected: false,
+		},
+		{
+			Input:    "john..doe@example.com",
+			Expected: false,
+		},
 	} {
 		t.Run(testCase.Input, func(t *testing.T) {
 			assert.Equal(t, testCase.Expected, IsValidEmail(testCase.Input))