As it is marked as HTML, the resulting email is a glue of text. We could also check if there is an cardnumber instead of Your cardnumber is (followed by nothing)
I should say: only a bit of HTML. There is one <a> tag.
I'll fix this as part of bug 35187
*** This bug has been marked as a duplicate of bug 35187 ***