qmail is bad. It doesn't respect standard Internet addressing indicators such as '%' and '!'. Mail to mailboxes containing '!' bounces into the admin mailbox. And qmail effectively issues a denial of service attack when it delivers mail.
This is the Frequently Given Answer to those claims.
You've obviously read the erstwhile ORBS web page on MTA security, at some point before ORBS disappeared completely, and have remembered what it said. These are the claims that ORBS made about qmail. The information about qmail on that page was inaccurate in pretty much every respect, however.
As reading the the Internet standards will confirm, the '%' and '!' characters are no different to other characters, and are not "standard Internet addressing indicators" at all, as ORBS claims them to be.
Contrary to the second ORBS claim, qmail either bounces messages, that are addressed to mailboxes containing the '!' character, to the envelope sender or delivers them.
The third ORBS claim is plainly ludicrous. Connecting to an SMTP Relay server, in order to use it for its intended purpose of transporting mail, is not a "denial of service attack".
ORBS really didn't know what it was talking about with regards to practically everything it said about qmail.