What 12,000 Spam Emails in 3 Hours Really Means (And How to Stop the Attack)

12,000 emails flooding a single inbox in three hours. Welcome to RandomNewsletter#4783…Confirm your subscription — click here…Free trial — activate now (Russian)

REAL CASE FROM THIS WEEK

12,000 junk emails received

Time window: ~3 HOURS
Mailboxes hit: 1 (TARGETED)
Business impact: WORK STOPPED

A small business owner called us this week in a panic.

Twelve thousand emails. In just a few hours. All in one mailbox.

Confirmation messages from newsletters he never signed up for. Account verification emails from sites he’d never heard of. Phishing attempts. Junk in five different languages. His inbox was unusable, work had stopped, and he had no idea what to do.

If you’re reading this and your stomach just dropped because something similar happened to you — or you’re realizing it could happen to you — keep reading. This is one of the more common attacks against small businesses right now, and it’s almost never just spam.

What This Attack Actually Is

What this business experienced is called an email bombing attack (sometimes referred to as a subscription bomb, list bomb, or mail bomb). The attacker takes a target email address and submits it to thousands of newsletter sign-up forms, account creation pages, and contact forms across the internet — all at once, often using automated tools and scripts.

The volume can hit thousands per hour. Every individual message is technically “legitimate” — meaning it came from a real sender that the bot signed the victim up for — which is exactly what makes traditional spam filters miss it.

How an email bombing attack works in three stages

  1. Submit Email Everywhere: Bot submits target email to thousands of sign-up forms.
  2. Inbox Floods With Junk: Confirmation, welcome, and verification emails pour in.
  3. Real Attack Hidden: Wire fraud, password resets, or account takeover buried.

Why You Should Be More Worried Than You Think

Here’s the part most people miss, and the part that should genuinely scare you:

The flood of spam is almost always a smokescreen for something worse.
While you’re frantically trying to figure out what’s happening with your email, attackers are usually doing one of these things in the background:

  • Stealing money via wire fraud or fake invoices.
  • Hiding active account compromise.
  • Burying important business communications.

The single most important thing during an active email bomb is to check for fraud and account compromise first — not just clean up the inbox.

What This Customer Did Right

In our customer’s case, the immediate response checklist looked like this:

  1. Confirmed MFA was already enabled.
  2. Forced a password change from a clean device.
  3. Called the email host to enable enhanced spam and phishing protection.

Smart moves. But that’s just the start of what every small business should be doing right now to prevent and limit the damage from this kind of attack.

10 Things Every Small Business Should Do

1. Audit for Account Compromise — Right Now

Before anything else, look for signs that someone is already in the account.

2. Verify No Money Has Moved

Call your bank. Check every business account. Look at the last 48 hours of transactions.

3. Enable Microsoft Defender for Office 365

The standard Microsoft 365 Business plan includes basic spam and phishing filtering (Exchange Online Protection, or EOP). It works fine for everyday traffic but gets overwhelmed during attacks like this.

4. Lock Down with Conditional Access

If you have Microsoft 365 Business Premium or Entra ID Premium P1, enable Conditional Access policies.

5. Configure SPF, DKIM, and DMARC

These three DNS records tell the world what email servers are authorized to send mail from your domain.

6. Disable External Auto-Forwarding by Policy

This is one of the most effective single changes you can make.

7. Turn On Mail Bombing Protection

Make sure it’s enabled. Third-party platforms like Avanan, Proofpoint Essentials, and Barracuda offer similar capabilities.

8. Use Email Aliases for Online Sign-Ups

Stop using your real business email for vendor accounts, software trials, and online forms.

9. Set Up Alerting for Unusual Activity

You shouldn't find out about an attack three hours in when a customer can’t reach you.

10. Have a Documented Incident Response Plan

When 12,000 emails start hitting your inbox, you don’t want to be Googling “what do I do.”

What This Looks Like When It’s Working

After the customer call, we got him on Defender for Office 365, audited the account thoroughly, set up DMARC, and enabled real-time alerting on unusual activity. Total cost: about $30 per month per user above what he was already paying.