Right on. I'm down with the tunnel concept.
Anyway, you've got the tunnel in, what about a tunnel out?
-bs makes sendmail speak STMP on stdin:
tunnel_out="ssh -q mailhost.net /usr/sbin/sendmail -bs"
It would appear that this is an alternative, but I imagine there's a
little error handling done in tunnel related to delays and such.
sendmail="ssh -q mailhost.net /usr/sbin/sendmail -oem -oi -bm"