Lotus Notes SMTP MTA is susceptible to being used as a mail relay for SPAM or other unsolicited
email. By connecting to the mail server (tcp25) and issuing a 'MAIL FROM' command with <> as the
argument, then issuing a specially encapsulated RCPT TO, an unauthorized user can relay email
via this server.
An encapsulated address looks like this: firstname.lastname@example.org
where yourdomain.com is the domain of the vulnerable mail server, and encapsulatedaddress
is the encoded destination email address. The encoding scheme is as follows:
replace "@" with "%".