We use this staging environment to do as-much-as-possible end-to-end dry-runs of real work, and thought that mailgun's sandbox functionality would be an ideal fit for this - we get to test everything up to and including the mailgun api to find regressions or other issues.
...until it started sending real mails; and when we talked to their support staff the response was the frankly astonishing "yeah, that's by design, sandboxes will send real mail out of the sandbox when under unusually high load" (paraphrased).
Seriously, W.T.F.
Now, of course we can and do do normal testing with entirely fake data, but data-distribution dependent failures happen; that's kind of the whole point of a staging environment. I'm not sure what the point of mailgun's sandbox even is if it's useless for staging.
Reported it a bunch of times, but gave up. No response, no fix... unfrotunate, because mailgun was a reaaally cool product