Comment by kris_wayton

Since you can insert arbitrary JS, it feels like you could write a loop that ajax posts a bunch of new webspaces when someone visits a webspace. Might look into protecting againt that.