a) Sendmail (tested with 8.9.3 and previous) allows you to put mail
addressed to eg. '|/bin/sh' (or any file) into mail queue. Fortunately,
this queue file should contain also line like 'Croot' to be processed
properly, while we have no idea how to put it there. But, anyway,
seems to be dangerous - Sendmail should reject such crap immediately:
/usr/sbin/sendmail -O 'DeliveryMode=d' '""|/bin/sh'
(without these double-quotes, it _will_ immediately drop your message)