Tenant blocked from sending email

eagles1927I found the root cause of this issue 🙂
SharePoint did it.

Guest users in the client's SharePoint had configured alerts on the document library, these alerts triggered for file change actions.
So when a large number of files were changed, SharePoint attempted to send 2 external users 1 email per file change, according to the SharePoint logs that was 97000 the first time 20000 the second ect.
SharePoint email notifications do not show up in your exchange as outbound (you will get an inbound trace if you are sending the alerts internally) but it appears MS will count them against the sending limits and lock your tenant. I'm not sure if internal ones would also cause your tenant to lock, but you would find it easily as you would see hundreds or thousands of them being delivered in message trace.

On a side note it was difficult to locate the correct Settings menu within SharePoint as the GUI would not let you navigate there directly, i had to go to the document library site home page and append "/_layouts/15/settings.aspx" to the URL to actually access the correct alert settings under 'user alerts', using the GUI we could only access the default site settings witch had no documents or alerts configured.

Also turning off alerts with the global settings/options had no impact on the user defined alerts (there may be a method using powershell but the GUI cannot be used to stop them)

It may also be possible that something like defender alerts could also cause this issue as i believe both SharePoint and defender use the same email setup, although it's far less likely you would have an alert setup that would trigger so many alerts and send the notification externally, but i can confirm these also do not show up in message trace for outbound.