Do not load content of emails flagged as "Phishing" or that failed domain authentication. This is can be a vulnerability.
Also as my previous feedback was deleted, when logged out by force, revoke session, right now this creates duplicate valid sessions (as shown on website dashboard)