He didn't say it was a CGI. In fact, I'm sure it isn't, hacker said it's email-driven, so CGI::Validate is right out.