What is the risk of unlimited email event triggering?

Question

Let's say I can trigger a mail event in a few scenario's without any a limit on that trigger. For example at:

1. Registration
2. Password reset
3. Newsletter subscription

The "registration" and "newsletter subscription" can be done on all email addresses and the "password reset" trigger likely only on existing accounts.

Is there any other risk than just misusing this mail trigger for sending annoying emails to email addresses, that didn't ask for it?

I was thinking in the direction of resource exhaustion because the mail-trigger might take more resources, so calling it more often on a larger scale takes resources on both sides, client and server-side.

Answer 1

Using the feature for "sending annoying emails to people who didn't ask for it" is indeed a real risk, as you point out. You could e.g. use this on a competitor in the hope that the random recievers will start marking the mail as spam, so that spam filters will catch on and start blocking your competitors emails. But let's leave that to the side and focus on the resource aspect.

If you want to exhaust resources, you should focus on the functionality that does most of the heavy lifting. Sending an email is not hard work. Other things, like login (computing hashes), advanced searches or generating large amount of data that can not be cashed are. An attacker is more likely to start there, and move down to less resource intensive tasks only when those are blocked. Sending an email should be very, very low down on the list.

The only situation I could think of is if your hosting provider has some rules against how many emails a month you can send (shared hosting often has lots of limitations of all sorts).

(This answer has focused on the server side. I am not sure what you mean by "client side" in this case.)