Disable users ability to create rules...

Andy David Well in this case the bad actor, we will call him Jimmy, intercepted an email about a incoming wire from a client to our company of a VERY large amount, using stolen credentials. Jimmy convinced the client to send the money to another bank account, telling them our original account was compromised. The client, thinking that the contact was still the proper person in our company, complied and sent them the money. 

Jimmy was smart enough to set up a rule for all incoming and sent emails to and from the clients domain to be moved to the RSS feeds folder, which no one on God's green earth uses, so that the real employee, whose credentials were stolen, within our company would never see them. 

A lot of things were done wrong by the client, there were quite a few red flags and they never called to confirm with us. We also should have had better security long ago. But one of the measures the company partners would like to make to help ensure this never happens again, is to stop all rules from being created. Or at the very least some form of alert whenever one is created. This is not a terrible request as it is a VERY common way the Jimmies of the world operate. 

You may think it unnecessary, but if you lost this amount of money maybe you would change your mind?

It may be extreme, but thankfully almost no one in our company uses rules. And it will put the minds of our accounting folks and partners at rest.

Thanks for your input!