Vulnerability in contact-form from 1.4 to 1.6.1.x that let spammers send emails to site clients.

[Kerm]

As we all know not so long ago, spammers found a vulnerability in the contact form on site that allows sending out emails, using the site's email templates, to site customers. In recent versions of 1.6.1 as i know problem is fixed. But can some one tell me where is problem and how to fix it on 1.4.x version?