Comment by ncann

Looks like the fix restricted the check to "usernames that end with dot and MIME type"

Still, what is the attack vector?