By default, the broad Mail.Send graph api permission was/is often used for applications/managed identities to send emails.
Obviously it is quite rarely the case that an SPN has to be able to send email as ANY user in your tenant…
So for DriftMaester at least, this has now been corrected by removing the Mail.Send permission and instead using an Exchange Online custom RBAC assignment scoped to only the email you specify 🙂