Another Security Tutorial for PHP, this one on Email Injection. This is how a lot of Spammers take over poorly written PHP Mailers to do their dirty work for them.

There are a lot of ways to send anonymous emails, some use it to mass mail, some use it to spoof identity, and some (a few) use it to send email anonymously. Usually a web mailform using the mail() function generates emails containing headers with the originating IP of the server it’s running on. Therefore the mailform acts as a SMTP proxy. The input fields of the form may vary, but it is common to specify a mailform that gives you control over the subject, the message, and the sender’s email address.
Link: Email Injection – SecurePHP