Hi,
I have a potentially compromised account in my office tenant that I administer. Office threat management has now restricted the account to send any emails 4 times in the past 2 weeks.
3 times I was able to unblock the account but the 4th time when I tried to unblock it I got an error saying "Unable to unblock the account since it's been delisted too many times"
I have investigated that the account definetely hasn't been compromised they just need to send bulk emails with many bcc'd multiple times per day and I suspect that is the reason why Office automatically blocks the email cause it just thinks it's spamming.
I also have been in contact with the other tenant admins who are in the receiving part of those emails and they have no spam or block warnings in their end.
Does anyone know is there any settings in the tenant to make sure it doesn't get restricted again?
I was able to unblock it the next day but I am fairly certain it will get blocked in a few days again.
Thanks!
