In PHP mail form is being abused, the question asks for help finding how an e-mail script got exploited.
Finding security problems is normally within the scope of Code Review, and we routinely point out security problems even if the author doesn't ask about it.
However, does this question violate the "working code, to the best of my knowledge" requirement? What should be done with it?
To me, it is analogous to asking for a performance optimization when we know the code doesn't work with a big file. Take this question as an example Replacing non-ASCII characters, we know that his code will fail with big input but it still on-topic.
In this case, the code is sending mail, but there is a known security issue.
I would say that if the user includes the information in the show_error function, that this should be on topic, we could point out where vulnerabilities are, they aren't bugs that keep the application from doing what it was programmed to do.
This isn't a debugging exercise. It's more of an optimization exercise.
I am casting a Reopen Vote.
Looking at the message it looks like the recipient just doesn't exist, it looks like a fake E-mail was put in.
It seems to me like the OP is asking about code not yet written when he says "I am trying to figure out a way to secure this form so that individuals cannot abuse this form and send mail to others through it." If he said he was looking for ways to improve the security, then it could be a review. Seems to me that he is looking for suggestions for how to implement security in the first place, and that would be a better fit elsewhere like SO.
