>But you also know they are accessing their email exclusively through an email client. What do you do? You can’t flag their account for a password reset, becaus

>But you also know they are accessing their email exclusively through an email client. What do you do? You can’t flag their account for a password reset, because there’s no mechanism in the email client to affect a password change.” > If only there was some way to communicate with a email customer... I'm not really sure what the issue here is. When the ISP knows their customer's accounts are compromised it doesn't matter what type of client they use to check their messages they absolutely can "flag the account for a password reset" by simply resetting the password or temporarily disabling those accounts. This forces the customer to call into the ISP the next time they try to check their email, verify their identity to the ISP, and then set a new password. The customer might be angry about having to take the time, but in most cases telling them "Your account was hacked and they were accessing your email messages" is enough to change their attitude from annoyed to grateful. You don't even have to wait for them to be compromised. I worked for an ISP that updated their system to require more complex passwords. They put out notices to get as many people as possible to reset their passwords then disabled every remaining email account in batches until everyone had called in to reset their password under the new requirements.