The source for that detail is here: https://bugs.chromium.org/p/project-zero/issues/detail?id=82...

> I think Symantec's mail server guessed the password "infected" and crashed (this password is commonly used among antivirus vendors to exchange samples), because they asked if they had missed a report I sent.

> They had missed the report, so I sent it again with a randomly generated password.

I'm not 100% sure I buy it. The follow up comment is about how he had mistakenly sent them a wrong testcase, and he had sent them similar exploits in a zip with the password infected before (see https://bugs.chromium.org/p/project-zero/issues/detail?id=81... from April 28th).

It would be incredible for Symantec to guess the password "infected" for ZIP files. It's possible though!