Comment 3 for bug 266323

Revision history for this message
Eric-black (eric-black) wrote :

Thanks for the suggestion. That helps if a user complains, but does not
help
in this scenario:

A malicious evil-doer discovers a spamtrap email address used by any of
the
many RBLs, and repeatedly submits that address in a subscribe request,
either by forging email (trivial to do) or by repeatedly submitting the
HTML
form (also trivial to do). The spamtrap receives multiple confirmation
requests.

The first confirmation request should be ignored, because typos happen.

Subsequent confirmation requests may well be considered to be spam.
Especially if there are 5 a day, let alone 100 in the space of an hour.