I found this paper a bit difficult to grasp due to the terminology being used. I kept thinking of completely different attack scenarios (communicating with port

I found this paper a bit difficult to grasp due to the terminology being used. I kept thinking of completely different attack scenarios (communicating with port 25 directly, somehow MITM an SMTP session) and had to re-read it several times. It seems all we're doing here is just bypassing validation used by common libraries behind email forms on websites. You attack by using malicious input (full spam email message) in the "email address" section of the sign-up form and it successfully lands in the MTA's queue and sends out. It wasn't clear if this can be defeated simply by disabling pipelining? If so, that seems like a sane fix if you don't feel you can trust your application.