Rookie mistake. The password is what we write on a sticky note and tape to the edge of our screen.

Birthright membership in the Domain Admins group is what keeps all our users from being pestered when they want to install that neat new tool they found. Then you don't need to harden the built in admin account against attacks, you can just disable it!

Hilariously if this is internal only, it may be "secure in transit" as most mail doesnt flow over SMTP in that case. Some vendors, including m365, also encrypt mail by default between other m365 users, and I think all of gmail last I checked.

If that password isn't then deleted from email or is otherwise archived automatically, then you have problems.