It's possible to access different users' files via email helper.
vulners.com/securityvulns/securityvulns:doc:23489