I've received numerous phishing emails from Salesforce user accounts and reported these to security at salesforce email. They have confirmed that the email had come from users' accounts; however, it doesn't appear they have upgraded their systems to prevent scammers and phishers from using it to defraud people.I'm well-versed in email sending infrastructure and reputation and find it highly unethical for Salesforce to move slowly on this one.
