I found this paper a bit difficult to grasp due to the terminology being used. I kept thinking of completely different attack scenarios (communicating with port 25 directly, somehow MITM an SMTP session) and had to re-read it several times. It seems all we&#x27;re doing here is just bypassing validation used by common libraries behind email forms on websites. You attack by using malicious input (full spam email message) in the &quot;email address&quot; section of the sign-up form and it successfully lands in the MTA&#x27;s queue and sends out.<p>It wasn&#x27;t clear if this can be defeated simply by disabling pipelining? If so, that seems like a sane fix if you don&#x27;t feel you can trust your application.