As some of you might have noticed the confluence server started to send out emails with an invalid FROM header as well as a prefix to the subject. The emails would have "Actividad sospechosa detectada" added to the subject header as well as made it look like they came from "Soporte BBVA Colombia <soporte@bbva.com><someemail>". These emails did indeed originate from confluence, but the outgoing email address of confluence was modified.
...