Nmap used to have a mode where you could portscan via a third-party FTP server.
And it just so happened that HP Laserjet printers had an FTP server active by default that allowed PORT to any IP.