Our web application offers users with the option to bulk email a bunch of interesting information to multiple email addresses at once. It's fairly easy to register an account with the service and thus it's pretty easy to start spamming people with email they never wanted to receive. You can't actually change the content of the email, but you can send it to any set of addresses.
My understanding is that if someone decides to troll the service and start spamming random people on the Internet from it, the company's domain might get banned from the major email providers out there and we're pretty much never getting ahold of legitimate users again through email.
Couple of questions:
- Is the above the worst case scenario or are there are aspects I'm not taking in consideration?
- What are some common and affordable (engineering-wise) prevention and mitigation practices that services use to deal with the above? I imagine that limiting the # of email that an account can send per day is one option. Also requiring that the account show some legitimate activity before it can send email is another valid approach. Anything else major I'm missing?
All other tips are greatly appreciated.