Security administrators attempted corrective action after a phishing attack. Users are still experiencing trouble logging in, as well as an increase in account lockouts. Users' email contacts are…

Disabling compromised accounts does not stop the email server's open relay from continuing to send spam and does not address the root infrastructure vulnerability enabling the ongoing attack.

Updating WAF rules to block social networks addresses a symptom (social networking requests) but does not remediate the email relay abuse or authenticate outbound mail, leaving the primary attack vector open.

Removing compromised accounts with all AD groups is destructive, time-consuming, and premature before confirming full scope; it also does not stop the email infrastructure from being abused.

Changing compromised account passwords is a valid remediation step but does not address the open relay or lack of SPF that are actively allowing spam to propagate through the mail server.

Disabling the open relay on the email server stops attackers from using the organization's mail server to send spam on behalf of compromised accounts, directly addressing the symptom of increased spam complaints from external contacts; an open relay allows any unauthenticated sender to route mail through the server, making it a critical misconfiguration to close immediately.

Enabling Sender Policy Framework (SPF) publishes DNS records that specify which mail servers are authorized to send email on behalf of the domain, preventing spoofed or relayed emails from appearing legitimate to recipients and stopping further spam propagation at the DNS/email authentication layer.