The agency says a software misconfiguration allowed hackers to access the platform and to send spam emails.