content: Are they hosing the attachments?  Without that, that's not true. Plus something that buffer overflows exchange isn't going to do the same thing in a modern browser. So in reality they are exactly wrong and so are you.