The design flow in the way The Bat! 2.x displays messages allows attackers to spoof RFC 822 headers and more.