If you mail merge to e-mail, then surely those that you have mailed to will be the addresses in the data source? Maybe
http://www.gmayor.com/ManyToOne.htm will help with the merge (most likely in one to one mode)?
A second layer of protection would be to log the sent e-mails in an Excel worksheet as they are sent, using the Application_ItemSend event having performed a look-up from that list in the same macro to determine whether to send the message. Then you have to determine what to do with the unsent messages, in terms of logging and filing. It has the makings of a more major project than perhaps you envisaged.
Mail merge from a datasource of recipients would present a simpler solution.