It's the expectation of the user that this is hacking. Inserting the HTML into a non-Intro user's email wouldn't make sense. But sense the user is expecting that data, and for it to be validated, spoofing it becomes much more valuable.

You have to manually accept the profile that allows this. Of course many people have no idea what a bad thing this is.