anonymous can read emails list scheduled for download polling ...

with no permission over mailhandler module other than uid=1 ... hence i expect nobody will know anything about mailhandler

if you follow
?q=admin/mailhandler/retrieve/1

you will see the full list of the mboxex stored in mailhandler table

this has to be avoided mailnly for privacy reason ... and for anti-spam behavoiur.

thanks
kind regards
alberto