I think the fact this was possible via the use of CF workers invalidates your point. Also, you choose to add the Domain Lockdown feature as a direct results of these findings.

I'd feel pretty silly too if my "email filters" kept me from acting sooner on this problem.