faxspool in mgetty prior to 1.1.29 uses a world-writable spool directory for outgoing faxes, which allows local users to modify fax transmission privileges.
gert doering mgetty