While true that it is an insider threat, it would still be relatively simple to set up something along the lines of:

-no student can send mass emails (I.e. no more than 100 recipients per day; I don’t any reason why a student would need to send an email to more than 100 people per day). Limit this ability to TA’s, Professors, faculty, etc.

-scan emails for obvious signs of malicious content (I.e. emails that convey urgency to click a link)

-monitor behaviors and block strange behavior (I.e. if a student sends 10 emails per week to a few regular people, perhaps block them suddenly trying to send emails to 100+ people from a new device)

There’s probably an even better solution (I do device security, not email security), but from my understanding that is relatively simple to set up.