You have a tracking image embedded in the emails. It points at a redirector script which does no validation of the destination url. This is highly abusable. Example:

http://r.posterous.com/track/?redirect=http%3A%2F%2Fgoogle.c...