This plugin does send spam and needs a captcha integration

This is how it happens. Bots are spaming all unprotected forms. For that matter they use harvested email addressesto fill in the email field. This plugin sends to those addresses a confirmation message, but these people know nothing about your site. So after it happens to them the third time, they repport you for spamming.

That happened to me, I investigated the issue on my postfix, and come to the above conclusion. I had to disable the plugin until further notice since I could not find a captcha integration.

This could result in getting your ip blocked in case your server tries to send confirmation messages to a significant number of fake outlook or gmail addresses.

It IS a verry serious issue.