cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).