Failed authentication not properly managed - at the best reported as a failed From address

In the definition of the function SmtpConnect() , if Connect() is succesful $connection is true at the end, even if authentication failed. One may think that, because there is a connection, we want it to be true. Actually, we don't becauise, if at the beginning of the function SmtpSend() the value of $this->SmtpConnect() is true, the remainder of the function is executed : the value of $smtp_from is checked, etc. This is a security risk. If we are lucky, the failed authentication will be reported as a failed From address, but we shouldn't rely on that.

In the fonctiion SmtpConnect() , I suggest to move the assignement $connection = true before every thing else inside the body of the if($this->SMTPAuth) statement and also add an else section to that if statement and copy again $connection = true in there. In this way, $connection will only be true if authentication succeeded or was not required,

I report this bug here because it is also a non expected behavior, irrespectively of any attack. When authentication fails, it should be reported a failed authentication, not as a failed From address. It is not just a securirty risk. It is very confusing to be told that the From address failed when, in fact, we simply failed authentication.