We have a large number of power users and have discovered what we believe to be a significant security issue.
Currently, any power user can send an email from the platform that appears to come from any email address within our domain. They can also add any recipient they choose in the CC field.
For those of you who also have a large number of power users, how have you addressed this risk?
As a precaution, we have disabled the ability to send emails from the platform. Unfortunately, this also means that automated email notifications are no longer being delivered.
We would greatly appreciate hearing how others are handling this issue and whether you have implemented any safeguards or alternative solutions.
Thank you in advance for your insights!