I got lots of theories but no solid answers. One person suggested using callbacks but the hooks aren't there for the logic he proposed. Another person suggested overwriting the assignment method, but I wondered about the update_attributes method undermining it. It turns out the latter calls the former so it's safe.
I wrote some unit tests today and started experimenting and found a solution that seems to work nicely (and consistently).
class Sender < ActiveRecord::Base
raise 'Sender.email is immutable!'