A shared mailbox represents a function such as support or billing while access is delegated to one or more users.
Common permissions include reading the mailbox and sending as, or on behalf of, the shared identity.
Audit the delegates
When somebody changes roles, remove access deliberately. Shared resources can accumulate permissions because nobody owns periodic review.
Do not share one password among a team when the platform supports delegated identities and auditable access.