An interesting bug has been found in the .net framework. Basically if a null is inserted into a string and you manipulate that string through several different methods then the data after the null will be dropped.

MailMessage message = new MailMessage()
message.to = request["to"] + "@legitserver.com"

if request["to"] were to be something like i@spamvictim.com%00 the message.to property would become i@spamvictim.com instead of what you would expect as i@spamvictim.com@legitserver.com

the reason behind this is that .NET treats nulls as data where the native calls that .NET uses behind the scenes treats nulls as string terminators (many languages internally terminate strings with nulls).

More info on this can be found in the whitepaper on this here

Two patches have been released from Microsoft to address this issue:
KB928365 for .NET 2.0
KB928366 for .NET 1.1