A stolen sending account comes with something more valuable than a password.
It comes with history.
An established mailbox or email-service account may already have a recognizable sender name, legitimate contacts, authenticated infrastructure, normal traffic patterns, and a reputation built over months or years.
An attacker who gains access can borrow all of that temporarily.
Amazon Web Services describes the problem directly in its guidance for Amazon SES. If credentials with permission to send mail are compromised, a malicious actor can use the customer’s SES account to send spam or phishing messages. AWS warns that the resulting bounce and complaint rates can damage sender reputation and can lead to the account’s sending ability being paused. See AWS guidance on securing compromised email-sending credentials.
The attacker gets the delivery channel.
The legitimate owner gets the cleanup bill.
Reputation can be stolen without being transferred
Email systems rely heavily on accumulated trust signals.
A domain that has sent normal correspondence for years looks different from a domain registered this morning. A known coworker’s address looks different to a recipient from an unknown sender. A mature cloud account with authenticated sending may initially look less suspicious than a brand-new operation.
Account compromise exploits that difference.
The recipient sees a familiar identity or reputable infrastructure. The attacker sees camouflage.
That does not mean every message from a compromised account will bypass filters or fool recipients. Sudden volume, strange destinations, unusual content, login anomalies, authentication failures, and complaints can expose the change quickly.
But the abuse starts with borrowed credibility.
The legitimate owner pays twice
First comes the security incident.
Then comes the reputation incident.
The owner may need to rotate credentials, investigate access logs, contact recipients, remove malicious rules, repair domain reputation, handle abuse reports, and convince providers that the account is under control again.
Recipients also pay a trust cost. A real person’s mailbox becomes evidence that even familiar identities need verification when a message suddenly asks for money, credentials, or an unexpected click.
This is why compromised accounts matter to Spam Empires.
Industrial abuse does not always build a sender from scratch.
Sometimes it steals a good one for the afternoon.