Ohh, we just had an old account with 2FA (so password not reset) apparently hijacked and used to send spam (a different kind I hadn’t seen before). That is a good indication some service that uses auth tokens got hit. Now to figure out which