It probably isn't allowed but is able to respond to e-mails. If your injection works, the allowed constraint is bypassed.