Finally someone using their head instead of just blindly speculating. SQL keeps history of commands as well. Plus if this company is so "advanced" that they use some kind of SQL procedures to send email, I am sure there are plenty of other audit trails they can follow to verify where the message came from.

All-in-all, the fact that he mentions he exploited security hole in his company and then calls it "SQL thing" screams at me: FAKE