In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.
No PoCs from references.
- https://github.com/fkie-cad/nvd-json-data-feeds