Your Vendor Is Sending Emails You Did Not Approve — Here Is What to Do About It

This Is an Uncomfortable Story But You Need to Hear It

I want to talk about something that happened to my business because it could happen to yours, and most people do not realize the risk until it is already a problem. This is about vendor accountability and what happens when someone you are paying to do a job starts doing something very different from what you hired them to do.

For my business, email is one of the main ways I generate leads. I run cold email campaigns to reach potential clients, and I am very deliberate about making sure every email we send is compliant and relevant to the people receiving it. That is not just a legal consideration — it is a deliverability consideration. Bad email practices destroy your sender reputation, which means future emails end up in spam even when they are legitimate.

So what I am about to tell you should not have been possible. But it happened.

What I Found in My Master Inbox

One day I was going through my master inbox and I started seeing emails that I had not sent. Not just a few. A significant number of emails going out that I had not written, had not approved, and had nothing to do with the campaigns I was running. And they were getting a ton of negative responses — people marking them as spam, replying with complaints, the kind of engagement that signals to email providers that something is wrong.

My first instinct was to figure out who was responsible. It could have been me — maybe I set something up and forgot. It could have been someone on my team. Or it could have been the inbox provider I was using.

After digging in and making some calls, I found out it was my vendor. The company I was paying to manage part of my email infrastructure had been sending emails from my accounts without my knowledge or approval.

The Part That Made It Worse

Here is what really got me. I had not heard from this vendor in months. They had been completely ghosting me. No check-ins, no performance updates, no communication at all. And during that radio silence, they had been actively doing things I had not authorized.

After I started making calls and asking around, I found out this was not an isolated incident. This was happening across the email space. Multiple businesses dealing with the same type of situation from vendors who had apparently decided that the rules of engagement they agreed to no longer applied to them.

I do not know what changed. I do not know what switch flipped. What I do know is that this is unacceptable behavior and that I should have caught it sooner. The lesson I took from this is about vendor auditing, and it is a lesson I think every business owner needs to apply.

How to Audit Your Vendors Before Problems Start

The first thing you need to establish with any vendor is a regular communication cadence. If a vendor goes more than a few weeks without any kind of update or check-in, that is a red flag. Active vendors who are doing their jobs want to show you results. Silence usually means something is wrong.

For email specifically, you need visibility into what is actually being sent from your domains. You should have access to your master inbox and you should be reviewing it regularly. If you are using an email platform or a vendor to manage your outreach, you should be able to see every campaign that goes out, every sequence that is active, and every account that is sending on your behalf.

If you cannot see those things, ask for access. If the vendor resists giving you access to your own data and your own sending activity, that tells you everything you need to know.

The second thing is to review the actual emails being sent, not just the reporting metrics. Reporting can be manipulated or cherry-picked. Looking at the raw output — what is actually going into people's inboxes — gives you the real picture. Are the emails on brand? Are they compliant with the agreements you have in place? Are they the kind of message you would be comfortable putting your name on?

Protecting Your Reputation Is Your Responsibility

The hard truth here is that when something goes wrong with a vendor, your business takes the hit. Your domain reputation suffers. Your brand gets associated with whatever the vendor was doing. Clients and prospects who received those emails do not know it was a vendor error — they just know they got a bad email from your company.

That is why vendor auditing is not optional. It is a core part of running a business responsibly, especially when you are outsourcing anything that touches your communications or your client relationships.

Go through your vendor list right now. For each one, ask: when did I last hear from them? What exactly are they doing on my behalf? Do I have visibility into that work? The answers to those questions will tell you exactly where your blind spots are.