You can build Balsa without HTML support at all. Or you can build HTML support and tell it to prefer text parts.
However, the callback problem you mention doesn't come from HTML itself but from references to external entities on HTML. Balsa is spam-safe in that sense as it never fetches those entities.
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds