Your right my bad, it has been like that since the v2 release.
function mail_delete()
{
global $db,$ir,$c,$userid,$h;
$db->query("DELETE FROM mail WHERE mail_id={$_GET['ID']} AND mail_to=$userid");
print "Message deleted.
[url='mailbox.php']> Back[/url]";
}