I doubt they intended something like this to be possible, but what remains to see is whether or not they'll be OK with it. I wouldn't be surprised if Apple disabled :hover and other interactive CSS features within Mail.app in a future update.

Apple has blocked apps for a lot less than providing a feature that intercepts users' email and email password to circumvent Apple's own sandboxing and inject content into their mailbox...