As a dev currently working at a company where getting an access request fulfilled can sometimes take weeks, I feel this author's pain.

But it seems like an enormous security hole, even with a codeword "password". The author didn't mention it, but I hope they're using whatever version of their company's E2E email encryption is for these messages.

Yeah, this is textbook "shadow IT" that could easily lead to something going seriously wrong. It's a fun example, but not something to aspire to.

Ultimately the problem is that in a lot of big corps, IT is basically unaccountable for setting things up wrong. Their only KPI is tickets closed, not the quality or success rate of their fixes.