Best of the inbox: recovering from a list-bombing attack

Best of the inbox: recovering from a list-bombing attack
A rare incident writeup with timeline and recovery metrics — useful because it WILL happen to a public signup form.

🚀 Deliverability
— 2,000 fake signups in an hour, then a reputation crater — Bots stuffed a form; the welcome blast hit thousands of unrelated inboxes and the complaint rate spiked to 0.8%. Worth your time: the recovery playbook is specific — they segmented anyone who signed up in that window, suppressed them, and ran a slow re-warm.
— What actually fixed it — Adding a hidden honeypot field plus a delayed double opt-in; bot signups fell ~98% and complaint rate normalized in 9 days.

Made the cut as a 'here's the fire and here's the extinguisher' case, with numbers on both.

Saved you ~2 hours and possibly a future deliverability disaster.