Finally found a solution: strings containing a special characters must be contained in CDATA sections AND those special characters need to be percent encoded.
So for the example above, this gives:
me@example.com
Note that the value Marks%20%26%20Spencer is also OK for the API.