HTML-exploit issue

[Rose, Bobby]

I have user trying to get these reports being setting from this one
service and at first it was being rejected by the HTML Form check.
After I allowed it, it's now being rejected by the content checking
saying that an HTML-Exploit was detected. But I don't know what exploit
it is.  It's not iframe or codebase, since I turned that off also for
this sender.  

What are the security exploits that MailScanner is looking at?  I need
to find that in the html code and compose something to the sender of
these messages so that they can be made aware of it.

-=Bobby Rose