But this (the e-mail DoS) isn't even an extreme case. When you have on the order of a million accounts, especially when you have large distribution lists, you need to consider this as an expected case (and the best practice solution is pretty well understood: limit send-rights to large distribution lists to the people who need it).

It's depressing how little effort Microsoft invests in trying to fix the obvious brokenness[1] of email (including reply-all) and (especially) calendaring. It's a particular contrast to the often controversially heavy handed actions by Google to "outlaw" insecure internet practises.

1: The brokenness is obvious, the solutions admittedly less so.