There was an attack last year on freenode which worked like this... javascript did an automatic POST to irc.freenode.net:6667 with form data that included IRC c

There was an attack last year on freenode which worked like this... javascript did an automatic POST to irc.freenode.net:6667 with form data that included IRC commands to spam channels etc. Unfortunately at the time their ircd didn't care about the 'POST / HTTP headers', and lovingly accepted the spam.