This can absolutely be malicious, is definitely a security bug, and should be fixed.
Imagine for instance that the input you found looks like this in the HTML:
Your Name: <input type="text" name="name">
name parameter is vulnerable to XSS injection. In the best case scenario (for the attacker), the page in question mixes up the POST body and the GET data, in which case this
name parameter is vulnerable regardless of whether a form was submitted. If this is the case, you can craft a payload that will be executed by someone simply clicking a link:
So the next thing you do is take your link which steals credentials, send an email to the "webmaster" email address saying, "Hey, something on your site broke when I did X. Here is a link to the page that broke for me". Then if the person clicks the link, you automatically steal their credentials and potentially gain administrative access to the site.
Granted, it is a multi-step attack vector, and there are assumptions along the way that can result in it not working, but the point is that even seemingly innocuous things like this are very dangerous, especially in the context of a site with generally poor security. Sometimes what seems like a little crack is actually large enough to drive a bus through, once you fully understand the implications.