[crumpled]

I think I figured it out. There is no validation. This is just a contact form and someone sees the plaintext password.