No detail given outside of it was disclosed to Apple a year ago, and - despite repeated gentle, respectful prodding - the problem still hasn't been fixed, so now the people who found it are revealing to the public that it exists, and the website reporter says they confirmed it. Coincidentally(?), Apple recently said they're going to change the way spoofed emails work - of course, the change will make it obvious it's a spoofed address so it'll be easy to reject them.