Gravar-mail: Risk-pooling--necessary but not sufficient?