Can you change a benign email to a malicious one after it has been sent? - YES , we have ROPEMAKER

Ropemaker - stands for Remotely Originated Post-delivery Email Manipulation Attacks Keeping Email Risky

A successful exploitation of the Ropemaker attack could allow an attacker to remotely modify the content of an email sent by the attacker itself, for example swapping a URL with the malicious one.

This can be done even after the email has already been delivered to the recipient and made it through all the necessary spam and security filters, without requiring direct access to the recipient’s computer or email application, exposing hundreds of millions of desktop email client users to malicious attacks.


More Details Here:
https://thehackernews.com/2017/08/change-email-content.html