TLS-RPT report addresses come from DNS, and quoted-printable in a rua=mailto: URI can put CR/LF into one. The address went into RCPT TO as it was, so the line break started a command of the record owner's choosing. Addresses with control characters, spaces or angle brackets are now refused when they're queued, and any already in the queue fail instead of being sent.