Seems like it’s his fault. I’m currently using the twilio API. A simple Python script could be used to filter out any messages that weren’t sent from an employee. He essentially has an unauthenticated open relay, a one way ticket to get put on a spam blacklist in the SMTP world.