I’ve pointed out that this issue could arrise so many times to companies with the all staff email. Every time they push back on wanting to define limited senders, “we don’t think it’s an issue/no one would do that!” Until someone sends an inappropriate email to the whole company, then it’s suddenly IT’s fault.