It was leveraged as part of an auto responding email function as part of a ticket that, when used as a secondary email address, allowed a password reset chit to be viewed and then used to change the password on the account.

I remember this one.

But it was fixed months ago. We patch nightly because enterprise software lets you roll back easily.