This is a difficult thing to control. In our organization we have a distribution list with all email users and have restricted who can send to that group. Occasionally someone gets “smart” and tries to send to “all users” instead, but they can only send to 1000 at a time as per our limitations. Usually by the time they get the third 1000 sent they either get bored and stop or we get them on the phone and tell them to stop. We have a clearly defined corporate email policy which states SPAM messaging to the organization is not allowed and emails sent to our company dist list have to be approved and sent from an approved sender.