There are frequent calls and open "Support requests" tickets regarding the creation of a new mailbox or the deletion of an old one.
A bigger problem than the creation is the periodic changing of the mailbox password, which people do not take seriously enough and take for granted;
"I already have that password, who knows how long... and what is missing from it"
She doesn't miss a thing and it's normal that it's not a priority for you to think about whether someone will break your password when the bigger concern is whether I have wages in my account.
But... catch 22. If someone breaks into your mailbox and starts sending spam messages from your email address, which is certainly not 100 messages, it is about hundreds of thousands of messages such as: Viagra, bookmakers, gambling, prostitution... with your company's logo or your name.
And in that case, the problem is because we are obliged to stop your server automatically in a very short time and you are likely to be blacklisted, and removal is another problem in addition to "salaries" because it is neither fast nor cheap.
So just change your password periodically and don't set it like you're fooling around like: 1234.