any information on how this issue:
affects SugarCRM security-wise? Normally, there can be no mail functionality directly trggered by user not logged in, but this is too big too speculate. I will open a case with SugarCRM, but also like to gather opinions here. I will report back when anything official comes out.