cPanel prior to 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
cpanel cpanel