I fail to see any real added risk here. Consider: Vacation can be executed
most once per incoming message, so the maximum number of database entries
vacation action can produce per incoming message is one. So, if the intent
to fill up the database, the simplest way to do it is set up regular
without a handle setting and send in a bunch of messages from different
sources. Note. however, that implementations are free to limit the number of
remembered responses, so this trick will only work if the implementation
The implementation may limit the number of remembered responses, but not
the number of databases. What's a reasonable lowest limit that scripts
should be able to rely on? 100?
I don't know if it's worth an entry under "security considerations", but
allowing the implementation to limit of number of databases sounds useful
to me. I never thought about a script using a large number of them.