FormMail.pl in FormMail 1.6 and previous versions allows a remote malicious user to send anonymous email (spam) by modifying the recipient and message parameters.
matt wright formmail