cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).Referenceshttps://documentation.cpanel.net/display/CL/68+Change+Log
