How did they make it work? Even given the passwords, how would they check robustly without tripping the email "unusual connection from IP x.x.x.x". Even if they

How did they make it work? Even given the passwords, how would they check robustly without tripping the email "unusual connection from IP x.x.x.x". Even if they have a few IP to make the checks, the mail server may notice that one IP is connecting to thousands of accounts.