typo3 -- email header injection

Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:

An unspecified error in the internal form engine can be used for
sending arbitrary mail headers, using it for purposes which it
is not meant for, e.g. sending spam messages.