Topic starter
11/08/2026 3:24 pm
TL;DR: A departing finance manager created a first-ever inbox forwarding rule to a personal Gmail and the case was flagged before offboarding disabled the account, even though login, device, and phishing-resistant MFA all looked clean, according to Artemis Security. The finding shows that strong authentication can coexist with mailbox-state abuse that survives account disablement.
Editorial analysis by NHI Mgmt Group, based on content published by Artemis Security: “Last Day Emails: The Exfil Channel Offboarding Doesn’t Close”.
Key questions
Q: What breaks when offboarding does not remove mailbox forwarding rules?
A: The offboarding process removes the user’s account but leaves a separate data-routing path intact.
Q: Why can a clean MFA session still be a mailbox security problem?
A: Because MFA proves who authenticated, not whether the mailbox action was appropriate.
Q: How do security teams spot risky forwarding behaviour during offboarding?
A: Correlate mailbox-rule creation with termination dates, then prioritise first-time forwarding actions and destinations that match personal addresses on file.
Practitioner guidance
- Add mailbox-state checks to offboarding Require rule enumeration, external-forwarding review, and delegate-access inspection before a mailbox is considered fully offboarded.
- Alert on first-ever forwarding rules Flag any new inbox rule that forwards or redirects to an external or personal address, especially when the mailbox has no prior forwarding history.
- Join identity lifecycle data to mailbox monitoring Correlate termination dates from the identity provider with mailbox-rule creation so a change becomes high priority when it intersects offboarding.
Bottom line: The breach surface here was not password theft or MFA failure, but a mailbox-level forwarding rule that could continue after the account was disabled.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:34 pm
Mailbox forwarding creates an offboarding blind spot when identity governance stops at account disablement. The control failure is not weak authentication, it is incomplete lifecycle coverage. A mailbox can still alter delivery behaviour after the identity has been marked for termination, which means the governance boundary was drawn too narrowly. Practitioners need to treat mail-routing state as part of the access surface, not as a separate operational detail.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
A question worth separating out:
Q: Who owns mailbox-state revocation in an identity programme?
A: IAM and IGA teams should own the control requirement, while messaging or collaboration administrators may execute the technical steps. The key is that mailbox routing, forwarding attributes, and delegate access must be treated as part of the offboarding standard, not as an optional mail admin follow-up.
👉 Read our full editorial: Mailbox forwarding rules expose offboarding blind spots in IAM