Mistaken identity

A wallet guards withdrawals with `require(tx.origin == owner)`. Why is that exploitable?