It's possible to include scripting object which fill be activated in case user reply or forward e-mail message. Host method of spreadsheet object allows creation and execution of arbitrary files.
vulners.com/securityvulns/securityvulns:doc:2701
vulners.com/securityvulns/securityvulns:doc:2716
vulners.com/securityvulns/securityvulns:doc:2846
vulners.com/securityvulns/securityvulns:doc:2853
vulners.com/securityvulns/securityvulns:doc:2986
vulners.com/securityvulns/securityvulns:doc:2989