edx-platform prior to 2016-06-10 allows account activation with a spoofed e-mail address.
edx edx-platform