Had something along these lines - a mail server that ended up used almost exclusively for sending automated internal emails. We’d migrated to a third party for email sending because managing DNS etc for clients got pretty painful. Mail server got removed by the tech lead and repointed to our third party mail provider without telling anyone, and 3 days into the months we’d hit our billing limit, on the lead’s day off. Turns out that one service had been sending an order of magnitude more email than all of our other services put together, as someone had been using email as a logging method.

That was a… fun day.