What came to mind first is a situation where like, your company has a public API endpoint that sends emails for your SaaS. It accepts destination and email cont

What came to mind first is a situation where like, your company has a public API endpoint that sends emails for your SaaS. It accepts destination and email content as parameters. One day you find a deposed member of Nigerian royalty has used it to appeal to an entire address list worth of strangers to help them get money out of the country. They're clearly desperate, that's why they used your password reset form's API. If your infrastructure is set up correctly, you can intercept that opportunity before it reaches the masses. Cut out the middleman. Deal with the prince directly. It's all yours now. It's your time. Daddy's eating steak tonight.