[ ] Disable or rotate the credential
[ ] Identify first and last unauthorized use
[ ] Export affected queue IDs
[ ] Identify MAIL FROM and recipient domains
[ ] Remove unauthorized queue entries if appropriate
[ ] Review source IP restrictions
[ ] Add sender authorization controls