Halloween Trick: Beware if your webform allows anonymous file uploads

See this security advisory
https://www.drupal.org/psa-2016-003

If you have a File field on your Webform, then your site can be used to host documents which can be made publicly available via the web. The webform need not be submitted to upload the file.