Yes.
Cluster mailboxes are designed to be opened with a master key. If a compromised Arrow Key is used, there may be no forced entry and no visible damage.
No broken lock does not mean no access.
See the full breakdown here:
👉 How It Happens: Mail Interception & Identity Theft
