Hmm, we are using htmlspecialchars for both the subject and body. I think the problem is we aren't using it for the feed title itself. It looks like the fix will be on line 2589 of libs/ubbthreads.inc.php
Currently, that reads:
$smarty->assign("feed_name",$feed_name);
when it should be:
$smarty->assign("feed_name",htmlspecialchars($feed_name));
