Cross-Site Request Forgery

Vic is one of your users. Mal has been able to guess his email address.