First pass, these one do not apply to us (and some of them do not apply to anyone at all):

CVE-2021-3603:

This one requires the attacker to be able to inject code into the server code-base, before they can use PHPMailer to activate that code.

I've changed my mind about "high count of CVEs", they give these out like candy.

CVE-2020-13625:

"No specific vulnerability has been found relating to this... could allow file attachments to bypass attachment filters..."

We don't do attachments (Maybe there's an option in Differential?) and we definitely not allow user-provided input for these things.

CVE-2017-11503:
One of the example files provided in the docs is skipping some validations. We lucked out here by not including the documentation.

CVE-2021-34551:
This one requires passing user-provided input as a filename to the "setLanguage" method; We don't call that method.

CVE-2017-5223, CVE-2018-19296 and CVE-2020-36326:

When passing un-filtered user input to various methods, PHPMailer might execute it or load more files.
We don't pass any such input (Unless there's a way to do that via importing ICS?)