Think about it this way: when you go to a Web page with a form, you're viewing a bunch of HTML that's rendered a certain way and has a link to a program on the server that is supposed to receive the data from the user who has filled out the form. That's the "ACTION" attribute in the FORM tag.

With me so far?

That remote program is not another HTML form, but an actual script or program written in Perl, C, or some other language. Within that program, you can do anything you want as long as you also remember to output valid HTML, usually the 'thank you' page.

With an email form, the script receives the data and turns it into an email message that's then "injected" into the email system on the server.

The only question becomes: does the recipient's email address show up in the form data on the original HTML page, or can it be hidden in the CGI script itself so that that address is hidden from users? With most email scripts, you're expected to include your email address as a hidden input element, but if you have control of the CGI script itself, it's straightforward to have something like

    addr="my\@email.address";

So if you can delve into the CGI script on the server, you can safely bury your email address on the server in a spot where no spammer can scrounge it for their own purposes. If you can't and you're stuck using an existing CGI script on the server, you might consider some of the workaround ideas discussed in the comments thread of avoiding mailto: links.

I hope this clarifies things!