This was a very real and demonstrated vulnerability. Perhaps I've misunderstood your comment.
Turkish emails are not supported in the first place.
Internationalization examples[edit] The example addresses below would not be handled by RFC 5322 based servers, but are permitted by RFC 6530. Servers compliant with this will be able to handle these:
Latin alphabet with diacritics: Pelé@example.com
Greek alphabet: δοκιμή@παράδειγμα.δοκιμή
Traditional Chinese characters: 我買@屋企.香港
Japanese characters: 二ノ宮@黒川.日本
Cyrillic characters: медведь@с-балалайкой.рф
Devanagari characters: संपर्क@डाटामेल.भारत
It is true that the RFC recommends mailbox providers take normalization into account. A mailbox provider that allows i and dotless-i addresses to be routed to different mailboxes is careless, if not actually uncompliant. I don't know if any popular provider does this: I'm guessing the authors created their own to demonstrate this attack.
There are no email addresses with Turkish characters at all. They all use Latin characters.
It just does not exist - yet at least.