One email a day

The mistake

The rate limit is applied per customer across all outbound mail rather than per message class, so a single bucket is shared by marketing blasts and transactional mail. The daily promo send fires first and consumes the quota, which means password-reset and sign-in-code emails are silently dropped for the rest of the day. Because the admin console also authenticates by emailed code, the limit locks out the person who would turn it off.