The attacker-controlled DNS record pointing to an internal private address or an explicit redirect is a classic, especially if they can control the event template being used and the service relies entirely on edge filtering... Too much template control is a risk.
I mean, there's a lot of things you should do when dealing with this that most people don't pay attention to: