I have a site which allows anonymous users to create a node with an image (the site allows people to submit images with quote memes so that the authenticity of the quote can be verified, quotefail.com).
I just learned, the hard way, that people can upload php code in the image field... somehow. That php code was then used to send out tons of spam from my server. Joy.
How can I make sure that image uploads are really, really only image uploads? This site depends on random people being able to submit images for validation, so I can't just disable the upload.