osCommerce Online Merchant v2.2 RC2a has bug where one can send out spam through

http://domain.com/admin/mail.php/login.php

The proposed fix for oscmax is:

http://www.oscmax.com/forums/oscmax-v1-7-discussion/20994-spam-through-admin-mail-php-login-php-action-send_email_to_user.html

The fix in OscMax is:

http://code.google.com/p/oscmax2/source/detail?r=169

Also what is going on with these files here:

http://www.oscmax.com/blog/michael_s/security_notice_oscmax_204_released