400 attempts and zero wins says more about the attack surface than the model. email is a pretty narrow channel for injection when you can't iterate on responses.