Messages (public and private) are able to be submitted through both POST and GET requests. I was able to post a link in the chatbox that people clicked which caused them to say things they didn't type themselves. Messages (and probably a few other opcodes) should be limited to POSTs.
https://ascorbic.net/catbox/archive/5155480/