[J_Darnley]

1 - True but cookies will get read and written upon connection to a server. Whereas most more advanced techniques require more.

2 - I agree with you on the user agent. Don't fake it unless you are going to make it more common. Perhaps turning Linux into Windows is a good idea (but make sure you do it right).

3 - I would say many if you recognise the sender.

4 - That's going a bit far. People can live without facebook but they usually fall back to email or other poorly protected methods.

5 - Agreed.