A famous expolitable formmail script would be formmail.pl from Matt's_Script_Archive, this entry provides links to articles discussing how formail.pl could be exploited. For an alternative see http://nms-cgi.sourceforge.net/, which also has further discussion of the problems and solutions. See Ovid's CGI Course for web based security do's and dont's, as well as Web Programming from the tutorials section of this site.

Update: Fixed link to tutorials, thanks Corion.