Re: oh, please
I’d suggest 2FA, but that boss would no doubt insist on an exception for their account...
I had a pre-uni job and got first.last@company.com, 6 hours later another person of the same name (no extra initials) started their permanent role at the company - time zones were cruel. They got first.last.2@company.com. Since I was sat with the relevant admins and only my parents actually had the address at that time I offered to let the permie (who would end up with the two for the rest of their career there) have the prime account, but was told to keep it.