Otherwise security should be set on Mail Message so Event_createPostMessage can modify them (to add the post as aggregate). This is annoying as mails are usually sent by Entity_sendEmail, which already has a Manager proxy role to allow to easily send Mail Messages to user without creating the related security.