To my mind, the WP team's response in the article is concerning.

Email addresses which no longer exists, which will result in a bounce-back are missing from the list of situations in which it can be exploited. i.e. All WP users everywhere that are registered with a defunct email address. Or forgotten mailboxes that are full. This set of people, plus those with an auto-response on their mailbox, is hardly a small number in absolute terms, given the number of WP installs out there.

And as the advisory notes, if the attacker attacks a particular individual, he can "prime the pump" by sending the intended victim enough mails to fill his mail quota, and thus guarantee a bounce-back "over quota" message. i.e. It's under his control. The WordPress security contact in the article above doesn't list this in his list of scenarios, even though the advisory does.

All servers that are dedicated to a single website, or which have a default, and which will respond with that website regardless of the host header, are vulnerable. That is also a significant number, and it would be reasonable to believe that it is disproportionately skewed towards large websites likely to have large numbers of users (because larger websites are more likely to have a dedicated webserver), and hence more likely to have more of the people in the previous paragraph.

The information that one developer checked whether he could reproduce this on two personal servers is more alarming than reassuring. The choice of "none of them" instead of "neither of them" to describe this reads like over-eagerness to spin, whether or not it was intended (rather than just poor grammar).

That he calls having a default host (which, as I say, is common when the server is only serving a single host) something which "We would consider that a poor server configuration" reads like an ad-hoc, post-facto response. There's no technical reason I can think of (and none given in the extract above) as to why that should be considered poor, and nowhere in wordpress.org's documentation where they document this. Can the WP security team document any webserver vendor saying this? Is it advice given in anyone's documentation anywhere, for that matter? As I say, it appears ad-hoc.