[wvl]

That was my first thought, however, from the docs:

MailerJS will send mail to the address you enter on your account page. You can't specify the receiver dynamically, as client-side JavaScript is publicly accessible by definition, and we want to protect you from spammers.

Why steal someone's api key just so you can send them email?

[oconnore]

(not something I would do, but someone else would) To put them over their account limit.