True enough, but it is fairly easy to restrict use of distribution groups in Exchange, which I would bet most of these orgs use.

I'd argue 1hr response is pretty slow for the NHS, since they require 24/7 support availability of even their vendors. I imagine they responded pretty quickly but nobody had a plan in place for situations like this and a large public sector organisation isn't a place conducive to one person taking charge and fixing the problem immediately.