“out-of-office” & NDR risks

As an Admin – I have always blocked out of office email messages, NDR’s, etc from leaving the firewall. It was always classified as two risky. The days of routing loops etc are over, but I hear that they can be hijacked to deliberately be used as a relay. can any one state how high this risk actually is?