I'm trying to understand if there is something more to it, because here is where I'm at, he found that some organizations has mistakenly or not configure their encryption gateways (MTAs) to accept mail from any host hence by connecting to them directly lets you bypass the anti-spam/virus filtering either directly to the mail server or by using the "trust" of the encryption gateway's IP?

He found some by spending time searching for them and gave the attach a name "the split Tunnel SMTP exploit".