Every good web programmer will note that the following contact form markup is probably flawed:
<form>
...
<input type="hidden" name="to" value="support@example.com" />
...
</form>
as it is likely that if the value of the “to” field changes, the message will be sent to the modified address. The problem with this kind of functionality is that it allows a malicious user to send emails from your mail server. More specifically, it can allow spammers to use your benign server to send their spam (and as a side effect, you might be flagged as a spammer yourself).
As this case is pretty obvious, one doesn’t see many real-life uses of it anymore (but careless programmers used it more often in the past until they learned better). However, one can achieve similar goals (spam-wise) by utilizing a common feature in contact forms: the “CC yourself” checkbox.

Continue reading “CC Yourself” and Spam