Of course there has to be a way to access email- how would they troubleshoot or fulfill legal investigations? The problem is that an attacker can follow the "l

Of course there has to be a way to access email- how would they troubleshoot or fulfill legal investigations? The problem is that an attacker can follow the "legitimate" path - and such attacks should be audited and detected, which is what obviously failed here. Makes you wonder how vulnerable less mature services are...