In your mail system, you seem to assume that all recipients of an mail exists, however recipients are chosen by a client, and checked in JS at the sender, but what about if the send button handler is changed from javascript:onSend() to javascript:SendMessage, that way recipients are never checked, and might include illegal recipients, which (since you seem to be missing an exception in the inbox), generates an unhandled exception, temporally paralizing the mailbox of that user.