In that same line of thinking, who gets the email @test.com?
http://contactx.test.com/contactX/contact-spam.cfm"We can NOT control what other people forge in an email return address header and send using thier computers."
Sure the issue is with the dev who made the mistake, but the result is nonetheless dangerous enough to warrant concern with security folk.