A logged-in Webtop user can skip the Webmail front end and feed the Media Transcoder file types administrators meant to block, defeating the configured allow-list.