“Ghost-Sender" is the result of a widespread misconfiguration, according to researchers, and evidence indicates it's being actively abused in the wild.
Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address
Summary + source link. No paywalls, no tracking.