The most common way a cybercriminal can compromise a corporate email account is to trick a member of the workforce into revealing their login credentials via a phishing email. Thereafter, the cybercriminal may be able to use the compromised account to send spam email, but is more likely to exploit the trusted source to send further phishing emails or BEC emails.