How to Protect Outbound Email in Google Workspace and Microsoft 365

Introduction

Email accounts are a major target for cybercriminals. If an employee's Google Workspace or Microsoft 365 account is compromised, attackers can use it to send hundreds or even thousands of spam and phishing emails. This can damage your company's reputation, affect email delivery, and put customers and employees at risk.

One effective security measure is to limit the number of external recipients a user can email within a specific period. This simple control can significantly reduce the damage an attacker can cause if an account is compromised.

Why Outbound Email Limits Are Important

Imagine an employee's password has been stolen. An attacker logs into the mailbox and starts sending phishing emails to thousands of external addresses. Without proper controls, the attacker may be able to send a large amount of malicious email before the security team notices.

Organizations can create a stricter outbound email policy, such as limiting users to 200 external recipients per hour or another suitable threshold based on their normal business activity. The exact limit should be chosen according to your organization's requirements.

Microsoft 365 Outbound Email Protection

Microsoft 365 provides built-in outbound spam protection and sending limits. Administrators can configure outbound spam policies to control:

• External recipients per hour — limits how many external recipients a user can email within an hour
• Recipient limits over time — additional controls for longer periods

Key steps for Microsoft 365 administrators:

• Review and configure outbound spam policies in the Exchange admin center
• Set appropriate recipient limits based on your organization's normal email patterns
• Monitor users who approach or exceed the threshold
• Configure alerts for unusual outbound email activity

Organizations that do not normally send large volumes of external email should consider a stricter limit and monitor users who reach that threshold.

Google Workspace Outbound Email Protection

Google Workspace also provides Gmail sending limits and protections designed to prevent abuse and spam.

Key steps for Google Workspace administrators:

• Monitor unusual outbound activity using Google Admin console reports
• Combine Google's built-in protections with other security controls
• Configure SPF, DKIM, and DMARC to protect your domain from email spoofing
• Set up alerts for suspicious sending patterns

Both platforms offer protection, but the key is active monitoring and quick response when unusual patterns are detected.

What to Do After an Email Account Is Compromised

Changing the password alone is not enough. Attackers may create mailbox rules, forwarding settings, or other methods to maintain access or hide their activity.

After discovering a compromised account, take these actions:

1. Disable the account temporarily if suspicious activity is still happening
2. Reset the password and revoke all active sessions
3. Enable or verify MFA for the user
4. Remove malicious email rules — check inbox rules, filters, forwarding rules, and mailbox settings
5. Check external forwarding — attackers may forward emails to an outside address
6. Review sent emails and email logs to identify phishing or spam messages
7. Check suspicious OAuth applications and remove unauthorized third-party access
8. Review devices and active sessions and remove anything suspicious
9. Search for other compromised accounts with similar activity
10. Notify affected recipients if malicious emails were sent from the account
11. Continue monitoring the account after recovery

Remove Malicious Mailbox Rules

Malicious rules are particularly important to check after an account takeover. An attacker may create rules that:

• Automatically delete security alerts
• Move messages into another folder
• Mark emails as read (so you don't notice them)
• Forward important emails to an external address

Administrators should carefully review mailbox rules and forwarding settings and remove anything that was not intentionally created by the user or IT team.

In both Microsoft 365 and Google Workspace, check:

• Inbox rules and filters
• Forwarding addresses
• Auto-reply settings (could be used to send malicious responses)
• Mailbox permissions (attackers may grant themselves access)

Final Thoughts

Outbound email limits are a simple but valuable layer of protection against compromised accounts. If an attacker gets access to an employee's mailbox, limiting external recipients can prevent the account from immediately becoming a large-scale spam or phishing source.

For stronger protection, organizations should combine:

• Outbound email limits
• Multi-Factor Authentication (MFA)
• SPF, DKIM, and DMARC configuration
• Email monitoring and alerts
• Regular account reviews
• Employee security awareness training

The goal is simple: if an account is compromised, limit the attacker's ability to spread malicious email and quickly remove their access before more damage occurs.

If you need help configuring outbound email protection or securing your Google Workspace or Microsoft 365 environment, contact SystemLogicIT for a free security assessment.