Exercise 3: Why a Forwarding Rule Is a Known Compromise Pattern — Possible Solution
====================================================================

WHAT THE FORWARDING RULE ACTUALLY DOES
------------------------------
Per this chapter, the rule was "quietly copying every incoming message
to an external address" - meaning a copy of the user's mail continues
reaching the attacker automatically, without any further action on
their part, for as long as the rule stays in place.

WHY THIS SURVIVES A PASSWORD CHANGE
------------------------------
Per this chapter, "once an attacker gains access, a forwarding rule
lets them keep reading the mailbox even after the original login is
noticed and the password changed." A password reset only closes the
original entry point (the compromised credential) - it does nothing to
the mailbox's own configuration. The forwarding rule isn't a form of
continued *access* to the account in the login sense; it's a
standing instruction the mail system will keep obeying regardless of
who is currently able to log in.

WHY THIS MAKES IT A PARTICULARLY DANGEROUS PATTERN
------------------------------
Most compromise responses focus on cutting off the attacker's login
access - resetting the password, revoking sessions, adding MFA. A
forwarding rule defeats all of that at once, because it doesn't depend
on the attacker being logged in at all going forward. The account
"looks" secured from the outside (new password, active MFA) while the
attacker continues receiving everything sent to it.

WHY THIS TIES DIRECTLY BACK TO THIS CHAPTER'S OWN WARN-BOX
------------------------------
This is exactly why the chapter warns against simply deleting the rule
and closing the ticket - doing so would remove the ongoing exposure,
but without documenting when the rule was created or what happened
while it existed, there's no way to know how much mail was actually
exposed or for how long, which is precisely the evidence Chapter 7
needs.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains what the rule actually does, explains specifically why a
password change alone doesn't stop it, and explains why that
combination makes it a well-known, particularly dangerous pattern
rather than just one more suspicious setting.