these mail should come from an internal account though right? Or is it possible to poison the output from the outside?