Is cgiemail compromised?

[Weevil]

In my latest This is True newsletter, Randy Cassingham posted this tidbit:

IT WASN'T A GOOD WEEKEND: Any of you with a web site, heads up: one of
the programs used to mail the results of a web form, which many sites
use to keep their e-mail address off the site to keep the address away
from spammers, has been compromised ...by spammers. The program,
"cgiemail", is used on a LOT of sites, and it's completely vulnerable.
If you're using it, you need to get rid of it ASAP! We spent the
weekend blocking out a spamming slimeball who was using my server to
send out his fraudulent pitches. Grr! So if you tried to update your
Premium address and got a weird error, or tried to send in an errata
report, or ask for info on putting ads in TRUE, etc., and got an
unexpected result, that's why. My friend (and Premium subscriber) Leo
of http://www.Ask-Leo.com spent HIS weekend writing me a program to
replace cgiemail, and making sure it worked on all my site's forms --
so the address change page (see bottom of this issue, if you need to
change YOUR address!), etc. are all working again now. Thanks VERY
much, Leo -- it wouldn't have all been done by now without you.

So, was this an isolated incident on Randy's server, or should those of using cgiemail on Jaguar be concerned?

Admittedly, This is True gets a lot more attention than any of my sites, so I'm probably not "at risk" like Randy, but it still concerns me.

What's the best recommended email mechanism to replace cgiemail with if I decide I need to do it?

[G.Bloke]

Well I don't know about cgiemail but I personally wouldn't rely on any thrid party apps that allow you to pass the destination address when the form is submitted.

It's far safer to use scripts that keep a list of addressess and then pass a reference to an address instead. I created one that uses a a mysql table of the different addresses that forms are submitted too. The form itself just has a unique reference which corresponds to an address in the table. I imagine that the same idea has been used in flat file form elsewhere.