In PHP mail form is being abused, the question asks for help finding how an e-mail script got exploited.
Finding security problems is normally within the scope of Code Review, and we routinely point out security problems even if the author doesn't ask about it.
However, does this question violate the "working code, to the best of my knowledge" requirement? What should be done with it?