When using a company email, sometimes unexpected things happen.

One day, you might receive a call from a client saying they received a strange email.

Upon checking, you find that dozens, or even hundreds, of emails have been sent to recipients you did not send.

If a hacker gains access to your email account's password or login credentials, they can use automated programs to send large volumes of spam or phishing emails.

Since company emails are trusted addresses by clients, the damage can be even greater.

So, what if we limit the ability to send one email to dozens of people or to send hundreds of emails in a short time?

Limits on Bulk Sending Can Be Set on Email Servers

Corporate email servers have features that limit the volume of emails sent. Typically, this is done by restricting the number of emails sent per hour, daily sending limits, and the number of recipients per message.

For example, you can limit an employee to specify a maximum of 10 recipients when sending an email and set a cap of no more than 50 emails sent per hour.

This way, even if the account is hacked, the damage from sending spam to thousands of people in a short time can be reduced.

However, not all email services allow for such flexible settings.

Microsoft 365, Google Workspace, and cPanel each have different limiting features and management methods.

Recipient Limits Alone Are Not Enough

Is it safe to prevent sending emails to more than 100 recipients at once? Not necessarily.

A hacker could bypass the recipient limit by repeatedly sending emails one by one using an automated program.

Therefore, it is advisable to use both account-specific sending limits and features that detect abnormal sending patterns.

For instance, if an employee who usually sends about 10 emails a day suddenly sends hundreds, an alert can be triggered for the administrator to check, or additional sending can be blocked according to policy.

Why Email Hacking Is More Scary

When spam is sent from a hacked email, it doesn't just inconvenience the recipients.

Fake money transfer requests or malicious links could be sent to clients, and the email reputation of the company's domain could suffer, causing legitimate business emails to end up in spam folders.

Additionally, if the sending server or domain gets blacklisted, it could take a significant amount of time to recover.

This can be especially serious for small businesses that frequently communicate with clients via email.

Is Changing the Password Enough to Solve the Problem?

If hacking is suspected, changing the password is a basic step. However, that alone is not sufficient.

You should log out of sessions on other devices, set up multi-factor authentication (MFA), and check for unknown email forwarding rules, connected external apps, and suspicious login records.

If necessary, the administrator should temporarily suspend email sending for that account and investigate the extent of the damage.

While email authentication technologies like SPF, DKIM, and DMARC are important, they alone cannot prevent a hacker who has taken over the actual account from sending emails.

The Best Approach Is to Limit Before Damage Occurs

Personally, I believe that it is rare for a regular office employee to need to send hundreds of emails directly in a day.

Therefore, there is no reason to grant unlimited sending permissions to all accounts.

Setting appropriate sending limits within the scope necessary for work and using separate professional sending services for newsletters or marketing emails is advantageous from a management perspective.

Of course, sending limits alone cannot prevent email hacking itself. However, they can serve as an important safety measure to prevent rapid damage spread if an account is compromised.

Just as cars have seat belts, company emails need the safety measure of sending limits.

Isn't it a much wiser choice to limit sending volume in advance rather than dealing with thousands of spam emails after a hack?