imo the biggest mistake here was in PandaForm trusting all of its user-generated content. It seems like they should have been doing some sort of verification o

imo the biggest mistake here was in PandaForm trusting all of its user-generated content. It seems like they should have been doing some sort of verification of the UGC. Alternately, if they really wanted to go with a fully laissez-faire no-security-checks approach, they shouldn't have picked a hosting company (in this case, Rackspace) that requires customers to sign an agreement that has strict anti-phishing rules.