We have a client website using Sprout Forms for a contact form. The client has queried a number of security topics with us, one of which is about Mail Header Injection attack protection (https://www.acunetix.com/blog/articles/email-header-injection/).
I've reached out to Ben at Barrel Strength and his response was that Sprout Forms uses the default Craft email service so any security steps Craft is taking they're piggybacking on.
The site is currently using the PHP Mail email setting.
Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks or would we need to implement any updates to protect against this?