That was my first thought, however, from the docs:

MailerJS will send mail to the address you enter on your account page. You can't specify the receiver dynamically, as client-side JavaScript is publicly accessible by definition, and we want to protect you from spammers.

Why steal someone's api key just so you can send them email?