[someonehere]

I wonder if they haven’t turned off the ability to use third party mail clients and enforce 2FA. It’s possible their accounts were compromised and someone was sending mail as them without their knowledge.

If the university has compromised credentials and allows third party mail clients to access without 2FA/unique codes enabled, then they’ve opened themselves up to being spammers.