http://lpoaj76nfopd5lpinbskyqtroppamrzhhay3g4vvjm75st6ger34lbyd.onion/posts/2020/08/email-sucks.html
Security SMTP is not authenticated by default. It would have been simple to just implement some TLS client auth or whatever, but no , that would break compatibility with servers that do not support TLS (which should not be a thing anyway, nowadays, mainly due to how simple Let's Encrypt is).