I can't think of worst, but the latest one I did was when I was coding a new "Contact Us" page into WHMCS.
The one provided by them doesn't support Amazon SES, gmail, or any other SMTP service that validates what
the 'from' address is. WHMCS actually forges the source email instead of properly...