[judge2020]

Part of the problem is effectively using this inbox as a "free" SMTP account so they don't have to pay for outbound emails. There would not be as much sensitive information in this account's sent/inbox if they using something like SES, which is incredibly cheap ($0.10/1000 emails).

[ballenf]

That's technically correct, but the real cost in using SES here is probably the development time:

- store all sent emails

- create an interface for business/non-devs to view and search past messages

If they were using all the functionality of this "free" SMTP approach, that's quite a bit of development + maintenance cost.