The description of the attack wasn't too clear, but there was enough to know that it's the kind of attack I call "script injection". The Zone is generally protected against those, since the filter strips out all script from messages, and doesn't allow (much) HTML in subject lines. When I designed the filter about four years ago, I did that on general principles. I've since learned a lot of JavaScript hacking techniques, which validates my original instinct.

This specific attack requires server software that blindly copies incoming browser data (sounds like the "referer" field, in this case) on to a page. I don't do that, anywhere. While they have a right to be aggrieved at the script kiddie, there's a programmer somewhere who shares responsibility for allowing the vulnerability. Validating and filtering all input from the field is a cardinal rule of server programming, because this is such a well-known attack strategy.