Okay, so is your definition that it's a bug if it allows for undesirable user behavior? Seems quite expansive. For SMTP I'd argue it's just missing a feature to mitigate or prevent spam. The word I would use there is "exploit". But I wouldn't say exploits and bugs are the same thing.