There is no mechanism to limit the request in places while send the preview email
There is a weak account registration process, which allow user to register and login without any email confirmation.
L’say say for example that i’m the user A that want to send a phishing email or perform DOS against a targeted user
CWE-400: Uncontrolled Resource Consumption
https://cwe.mitre.org/data/definitions/400.html
Below i have attached the evidence for the POC
The most common result of resource exhaustion is denial of service.