That sounds like we are on the right track. I am definitely using a different service account for my generic SAM management. I can close that session, but won't that cause the regular SAM monitoring to puke?
Right now, the service account I am using was one I already had. Frankly, I don't want to keep using it since it probably has waaay more rights than SAM requires, which is why I created a SAM-specific service account to use with AppInsight for Exchange. I would happily transition to that new service account for everything else in SAM, but I don't know what rights I need to grant. I have searched up here to no avail.