While this can be nasty, it doesn't stop there. I wonder what happens when G Mail's spam filter kicks in when one starts spamming through this e-mail interface, and the filter starts blocking Google's own e-mail addresses because of the large volume of e-mail that is coming from their own domain? It's probably also possible to get someone's e-mail address blacklisted this way.
Moreover the e-mail interface also accepts GET to submit the phishing e-mail:
This is an important message to all our Adsense customers. Google needs to
verify your Adsense account, every year we require you to change your password in
order for your safety. You must change your password within 10 days or your account
will be suspended.
Follow this link to change your password: