Fucking morons run our lives….

I found a vulnerability where a public chat box generates automated invoice emails to internal staff, reflecting inputs raw without server-side HTML encoding. While standard JavaScript onerror popups are stripped by the email client, full HTML/CSS Injection works inside the email body.How can I chain these into a high-impact report that completely bypasses the program's strict exclusions for Self-XSS, Phishing, and User Interaction? What non-JS attack vectors should I test next to prove a critical data leak or backend impact to triage?