Finds where user input reaches an email header, such as To, Bcc, Subject, Reply-To or a custom header, with a line break that can add recipients or change the message. Returns each injection path, the header it changes, and the validation to add.