I was about to comment the same thing. It's very simple but I don't think I would have thought of it

It's quite common, in fact my "go-to" hacked account rule in Office 365 is "alert me, system admin, anytime anyone creates an outlook/exchange rule".

Our group is small enough that I get very few alerts at all, and I've caught two compromises that way.

Thanks for the tip that's a pretty good one I wouldn't have thought of

Do you know if those alerts can also be set up on Google Admin?

To be honest, there is already zero way to distinguish between shipping and customer service messages from Amazon. If you order any appreciable amount of items you would have no idea they sent you any message.

Of course I only found this out after being burned by it. Turns out they’d sent me a message telling me the item I returned was not in the same condition it was sent in (it was), but the message was utterly lost in the flood of ‘order received/sent/delivered’ mails they send (with the same subject).

Another common technique is a filter to forward all mail. Hard to notice. I ought to go check right now...

I think Gmail has a big yellow notice in your account for 7 data after a new forwading e-mail address is added. That of course falls apart when you use an external client but there’s that.