If there is an HTML message, the preview pane will view it as a web page,
including activating javascript, etc.
You can increase security quite a bit by setting the "Security Zones" to be
"restricted sites." This is on the Security tab of the Outlook Expresss
options dialog. I don't have Outlook, so I don't know about setting it up.