So I looked at the code and made some changes that I'd like to confirm do not introduce any nasties:
I added at line 20:
$thissite = $_SERVER['HTTP_HOST'];
I changed the Subject code at line 40:
$subject = "Login Event: ".htmlentities($thissite)."";
I changed the message code on line 41:
$message = " WordPress Login Attempt".htmlentities($who)."\r\n On ".htmlentities($thissite)....
These changes produce an email of the form
Subject: Login Event: wordpress.org
WordPress Login Attempt By SomeUserName
=== All else remains the same.
Any problems with or objections to these edits?