[Klathmon]

I'm not a lawyer, but is that really true?

I could see the instance of an ex-employee that still can login can enter into contracts on your company's behalf, but a hacker doing so gets the same protections (for lack of a better word)?

That seems very wrong to me. I'm sure it makes things harder to determine the actual issue, but I just don't believe that a judge would look at this and conclude that fraud is ok as long as it comes from your email address...

(ignoring issues like gross negligence where a company is doing significantly less to secure their systems than should be expected)