At present, the email connector merrily ingests any emails which are sent to a public email address, where the subject matches and attachments match the regex.

With nothing being applied to even check who the sender is, let alone ensure they are who they claim to be.