Topic starter
14/07/2026 6:06 pm
TL;DR: Relay spam can turn support tickets into trusted outbound mail when public forms accept arbitrary addresses, according to Swarmnetics. Support workflows need verified-user gating by default, or they can be used as a delivery path instead of a service queue.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: “Zendesk Incident Demonstrates How “Relay Spam” Can Hit Support Systems, but How Big Is the Risk?”.
Key questions
Q: Why does trusted support mail create risk even when no account is compromised?
A: Because the recipient sees mail from an expected system and is more likely to allow it through spam and security checks.
Q: What are the signs that a support platform is being abused for relay spam?
A: Look for sudden bursts of tickets from many unrelated addresses, repeated strange or random subject lines, and large volumes of outbound receipts with no matching support demand.
Q: What breaks when support tickets can be created without verified users?
A: The support channel stops being a controlled service workflow and becomes a trusted message relay.
Practitioner guidance
- Enforce verified-user ticket creation Disable anonymous ticket submission for channels that generate trusted outbound email, especially where the system can reply from a branded domain.
- Separate intake trust from delivery trust Review support workflows so the act of opening a ticket does not automatically confer permission to send trusted receipts or follow-up messages.
- Restrict payload-bearing submissions Remove attachments and link fields from unauthenticated forms where the business does not need them, and log every exception.
Bottom line: Relay spam abuses the trust of support systems rather than breaking into them, which makes workflow governance more important than mail filtering alone.
Glossary terms: Relay Spam, Trusted-sender abuse, Verified User Gating
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
14/07/2026 6:11 pm
Trusted workflow abuse is a governance problem, not just a mail problem. Support portals can create legitimate outbound trust even when no account takeover has occurred. That makes the control surface broader than spam filtering alone, because the system itself is acting as the trusted sender. Practitioners should treat any customer-facing workflow that can emit email as part of the identity and trust architecture.
A question worth separating out:
Q: Should organisations allow anonymous support tickets if spam filtering is strong?
A: Only when the business can tolerate the abuse risk and the workflow cannot generate trusted outbound mail with useful content. Spam filtering helps, but it does not fix the trust boundary problem. If the system can send legitimate-looking responses, verified-user gating is the more reliable control.
👉 Read our full editorial: Zendesk relay spam shows support systems can be abused as trusted senders