Comment by saulrh

Let me get this straight: They were able to use a single helpdesk account password for six months to read arbitrary emails from arbitrary user accounts. There was no 2fa. There was no auditing. There was no integration with any sort of ticketing system ("you can only access an account if you're working on that specific user's ticket") or paperwork ("reason for access:"). There wasn't a single piece of automated monitoring to detect this account accessing accounts off-hours or accessing multiple accounts simultaneously. And this went on for six months. Did I misread something?