Email Addresses as Table Names, How to Use Prepared / "Safe" Statements?

(Insert usual "I don't have a lot of hands on SQL experience" here.)

I've got a system that's responsible for sending out a fair amount of emails, and I'm adding functionality to save records of each email, segregated by the recipient.

Right now I'm setting it up so that these email logs will upsert a table with their email being the table name. However right now, it looks like the pg library for Node.js doesn't allow using table names as part of the prepared statement.

My question is two fold, a) should I be conceed about injection when the able name will be based off of email address? And b) if so, how can I get around security conces here?

Example of how I'm handling this currently:

function _upsertTable(email, cb) {
  // Normalize email address.
  var tableName = 'email."' + email.toLowerCase() + '"';

  client.query([
    ("CREATE TABLE IF NOT EXISTS " + tableName),
      "(",
        "htmlMessage text,",
        "textMessage text,",
        "templateId character(24),",
        "files oid",
      ")"
  ].join(' '), cb);
}

// Insert email record into table
function _recordEmail(email, cb) {
  var tableName = 'email."' + email.toLowerCase() + '"';

  client.query([
    'INSERT INTO ' + tableName,
    'VALUES (',
      '$1,',
      '$2,',
      '$3,',
      'null',
    ')'
  ].join(' '), [html, text, templateId], cb);
}