> People connecting through our VPN have access to an internal-only SMTP gateway machine that doesn't require SMTP authentication.

This part sounds... not great. Even bad actor within org could send messages as someone else: president to payroll etc.