recommend_friends.php has a security leak

I noticed today that my site is letting outsiders go directly to the recommend_friends.php script and send out spam through my system. I tried someone else's site and it took me to the login screen. That was good. Mine just let them send emails. What gives?

For now I have disabled the script.

Hi,

You have to set 'Recommend Video' to 'Members Only'.
Go to Admin -> Site Settings -> Miscellaneous Settings -> Recommend Video.

Thanks,
Buyscripts Team.

Thanks. I think I turned that on a while back thinking it would be good for guests to recommend videos. However I just noticed that I was getting a lot of bounced mail back to my main account and found they were using a robot and that script to send out about 5 emails per minute. TURN IT OFF! Thanks.