Shell metacharcters are not checked in mail command
vulners.com/securityvulns/securityvulns:doc:1788
vulners.com/securityvulns/securityvulns:doc:3419