One time there was an application where it was quite important for the users to receive the e-mail notifying about a new document being created for them (it had to do with cost validation).
What I did was to break the process in two steps: first, compose the document, with all the information and recipients and save it to the database itself. Then, run trough the "unsent" mail view and process the sending - after doing doc.send, if no error occurred, I would then mark the document on the database as sent, so it would now appear on a sent mail view.
This would allow to check if the mail had been correctly composed (no recipient or information forgotten) and if it had been sent. More, if, for some reason, it failed to send the e-mails, there was a scheduled agent trying to re-send them. And the time of the "sending" would be registered, so it would be easy to lookup for it on the server's log.
Additionally, once a month, an agent can be run to delete (or move to a backup database) all the sent mails.
Not perfect or bullet-proof, but it has been helpful.