The mainframe era custom of giving employees three or four letter identifiers and using these as email adresses is vulnerable to dictionary attacks. It is also unpersonal.

At our company a simple relay filtering setup cuts more than half of all attempted email traffic. In off hours the number is much higher. Spam is not free in any sense of the word, the cost is just firmly with the recipient not the sender.