People still posting their mailaddress + reflink in Facebook..So anyone can just fill out the withdraw form for them and receive their tokens with another wallet address. How stupid is that!