Sophos Anti-Virus 3.78 allows remote attackers to bypass virus scanning by using a qmail generated Delivery Status Notification (DSN) where the original email is not included in the bounce message.
https://exchange.xforce.ibmcloud.com/vulnerabilities/15192
https://euvd.enisa.europa.eu/vulnerability/EUVD-2004-2080
http://www.sophos.com/support/news/#mime-378
http://www.securityfocus.com/bid/9650