Rlogin
The protocol partially depends on the remote rlogin client to provide information honestly (including source port and source host name).  A corrupt client is thus able to rebuild this and gain access.