[mike-cardwell]

Your site seems to display any arbitrary html sent via email. So it will load flash, javascript, honour meta redirects to other sites, etc. Try running it through https://emailprivacytester.com/

E.g: https://receiveee.com/1QQGEpdt/908

[kornnflake]

Thanks for the hint! Already fixed most of these attacks and looking forward to fix them all.

Btw: This fix only applies to new mails.