Several other protonmail accounts have set up auto-forwarding to my protonmail inbox (whether accidentally or maliciously I don't know). PM has a feature that a

Several other protonmail accounts have set up auto-forwarding to my protonmail inbox (whether accidentally or maliciously I don't know). PM has a feature that allows me to see who they are, but not remove the forwarding automatically. There does not seem to be any confirmation required to set up the forwarding, or any guard rails at all on the process. While this is unrelated to the core security of the application from a technical perspective, to me it seems shockingly sloppy and evidence of a severe lack of security mindset within the development organization. For comparison, gmail sends a confirmation code to the destination inbox that must be entered into the source email account.