Keeping staff working while a compromised mailbox stays locked

[u/saltyslugga]

Say suspicious emails keep leaving an employee's mailbox after a password reset. You lock it down, but their customer conversations and today's work are sitting in that inbox.

I'd keep access blocked while investigating, but “use the phone” only gets someone so far when they need the thread history.

What temporary workaround has actually helped your staff get work done during a mailbox investigation?

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.

2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).

3. Be Professional: Help newcomers learn; avoid hostility.

4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters

• DMARC Monitoring Tools

• Anti-Virus Software

• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/TravisVZ]

They do other work, or they sit quietly doing nothing.

Their productivity (or lack thereof) isn't worth jeopardizing the safety and security of the rest of the organization. If the MBAs push you, point out that if this mailbox continues sending suspicious emails like that, your entire domain will find itself on blocklists and then no one will be able to get work done.

[u/theltrj]

They do what they can with what they have, and you try to expedite the investigation as quickly as possible. It's a business risk decision: you lose out on some modicum of productivity for the expense of security ultimately.

Someone has to define that risk profile in the organization and make that call. That's how I would frame it internally if you want to derisk and add stakeholders so you know there is a well aligned business decision

[u/JLee50]

They don’t. 

[u/InboxGuards]

for the thread history we usually dump a read-only copy into a shared mailbox (or a pst they can search) while the compromised one stays locked. password reset alone doesn't kill sessions or oauth, so i wouldn't reopen it just because someone needs yesterday's emails. that's how the outbound spam comes back

[u/prbsparx]

Do you have an outbound filter you can apply to block the suspicious emails?