Borrower can send 3rd party collateral to arbitrary address