What's next? EXAMPLE.COM becomes an actual site?
I suppose a lot depends on your definition of the word 'actual', but there's definitely definitely something there replying on port 80, if nothing else.
http://contactx.test.com/contactX/contact-spam.cfm"We can NOT control what other people forge in an email return address header and send using thier computers."
Sure the issue is with the dev who made the mistake, but the result is nonetheless dangerous enough to warrant concern with security folk.