A flaw in Gmail can allow an attacker to forward all messages with attachments to another email address.