Topic starter
14/07/2026 6:06 pm
TL;DR: Relay spam against Zendesk-style support systems can turn trusted ticket receipts into unwanted messages, with attackers using public-facing ticket forms and legitimate return addresses to bypass spam filtering, according to Swarmnetics. The governance lesson is that convenience features become an abuse path when verified-user controls are optional rather than default.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: “Zendesk Incident Demonstrates How “Relay Spam” Can Hit Support Systems, but How Big Is the Risk?”.
Key questions
Q: What breaks when support tickets can be created without verified users?
A: The support channel stops being a controlled service workflow and becomes a trusted message relay.
Q: Why does trusted support mail create risk even when no account is compromised?
A: Because the recipient sees mail from an expected system and is more likely to allow it through spam and security checks.
Q: What are the signs that a support platform is being abused for relay spam?
A: Look for sudden bursts of tickets from many unrelated addresses, repeated strange or random subject lines, and large volumes of outbound receipts with no matching support demand.
Practitioner guidance
- Enforce verified-user ticket creation Disable anonymous ticket submission for channels that generate trusted outbound email, especially where the system can reply from a branded domain.
- Separate intake trust from delivery trust Review support workflows so the act of opening a ticket does not automatically confer permission to send trusted receipts or follow-up messages.
- Restrict payload-bearing submissions Remove attachments and link fields from unauthenticated forms where the business does not need them, and log every exception.
Bottom line: Relay spam abuses the trust of support systems rather than breaking into them, which makes workflow governance more important than mail filtering alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 6:11 pm
Trusted workflow abuse is a governance problem, not just a mail problem. Support portals can create legitimate outbound trust even when no account takeover has occurred. That makes the control surface broader than spam filtering alone, because the system itself is acting as the trusted sender. Practitioners should treat any customer-facing workflow that can emit email as part of the identity and trust architecture.
A question worth separating out:
Q: Should organisations allow anonymous support tickets if spam filtering is strong?
A: Only when the business can tolerate the abuse risk and the workflow cannot generate trusted outbound mail with useful content. Spam filtering helps, but it does not fix the trust boundary problem. If the system can send legitimate-looking responses, verified-user gating is the more reliable control.
👉 Read our full editorial: Zendesk relay spam shows support systems can be abused as trusted senders