Our contact form mails from an address nobody reads and puts a stranger in Reply-To

Why the From header is ours and the Reply-To is the visitor's, what gets escaped, and the one validation rule the form never tells you about.