This is a good point. We have anti-spam measures in place and allow users to configure allow/blocklists to mitigate attacks.

What about a concerted attack?

Spam doesn't matter for an agent mailbox, but sophisticated fraud does.