<ul>
<li>\"" & content of _msg & "\": should probably use quoted form</li>
<li>tell application "Mail" to mailto "#{mailto.gsub(/'/,"\'")}": shouldn't this be gsub('"', '\"')?</li>
</ul>

#!/usr/bin/env ruby

appname = "SomeApp"
codes = %w(25070852 10195893)

`osascript -e 'tell app "Mail"
    repeat with msg in (get selection)
        do shell script "echo " & quoted form of (get all headers of msg) & " > /0/headers-$(uuidgen).txt"
    end repeat
end tell'`

matches = {}
dir = Dir['/0/headers-*.txt']
dir.each {|message|
    match = File.read(message).scan(/^From: (.*) <([^ ]*)>$/)[0]
    matches[match[1]] = match[0]
}
picks = matches.sort {|a, b| rand <=> rand}[0,codes.size]

winners = "<ul>"
picks.each_with_index {|pick, i|
    email, name = pick[0], pick[1]
    mailto = "mailto:#{email}?subject=Congratulations #{name}, you won!&body=Here is your promo code for #{appname}: #{codes[i]}%0A%0AThanks for reading!"
    p mailto
    link = %Q{<li><a href="#{mailto}">#{name} <#{email}></a></li>}
    winners << link
    # `osascript -e 'tell app "Mail" to mailto "#{mailto.gsub('"', '\"')}"'`
}

File.open("/0/#{appname}-winners.html", "w") {|o| o.write(winners)}
`rm /0/headers-*.txt`

The script gets the name and email address from the header. (So it's not specific to Wordpress notification emails.) It doesn't check for IPs though.