Scammers can abuse security flaws in email forwarding to imp