[jamesfinlayson]

I once fixed a Contact Us form that allowed the recipient email address to be overwritten, so anyone could put their spam in the body and sent it to anyone via that form.