How do attackers gain access to sending infrastructure?

ESP account compromise: attackers steal credentials to ESP accounts, gaining ability to send from the victim's reputation and authenticated domains. Phishing ESP users yields high-value access.

API key theft: exposed or stolen API keys enable sending through victim infrastructure without full account access. Keys in code repositories, logs, or breached systems enable abuse.

MTA/server compromise: attackers gain server access through vulnerabilities or stolen credentials, then configure unauthorized sending. Internal network compromise can reach mail infrastructure.