I actually saw this attack used in the wild just over 10 years ago – so I guess it's one that spammers have long since been aware of. In my case we had a serve

I actually saw this attack used in the wild just over 10 years ago – so I guess it's one that spammers have long since been aware of. In my case we had a server that was running Adobe Coldfusion suddenly start misbehaving itself. After digging around a little we discovered all the outgoing email. I can't remember the exact form but it was something like a forgot password mechanism. As described in the article the attackers were just exploiting the non-validation of the recipient so they could inject an smtp payload. I remember at the time thinking that it was a) clever of the hackers and b) sloppy of the entire pipeline to not be doing some sense checking.