Make sure only authorized persons can use the Mail Sender API

I thought I had put some permissions check but I cannot find them. We need to make sure that not everyone can use the mail sender scripting API to send mails to anyone, making XWiki a spam proxy... (for example xwiki.org or myxwiki.org)