IT is immediately alerted. Admins can lock the account, remove all malicious messages, and notify affected users or external contacts—helping contain the threat and minimize business impact.