I don't understand the hate against Timo. It's pretty obvious from the article that he only thought about the recipient side and not about the sender (postfix). Postfix does behave wrong (according to e.g. RFC 2822 section 2.3), but it still was not in scope of the article.

The disclosure did go to the parties who he (or SEC Consult) seemed vulnerable.

If anything it just shows that Wietse have a way better understanding of SMTP than most of us normal humans.