Compromised email

Question

I believe my email has been compromised, I have thousands of email going out of my send box by Comcast.net per day. This only allows me to send one email per day. I try to delete all the sent emails and it end-less to delete.

Please help

Duane Gau

******@hotmail.com

Answer 1

Hi. I'm Brian.

Do you see the messages in your Sent Items folder? If you're using a Comcast account, if you log into your account with a web browser, do you see them there as well? If your Comcast account has been compromised, you must contact Comcast. It's not a problem with Outlook.com.

Answer 2

The symptoms described match a compromised Outlook.com/Microsoft 365 email account that is being used to send large volumes of spam, which also causes sending limits to be hit so only a small number of messages can be sent per day.

Take these actions in order:

1. Secure the account immediately
   1. From a clean device (that has been scanned for malware), sign in to the Microsoft account and change the password to a strong, unique one.
   2. Enable multi-factor authentication (for example, via Microsoft Authenticator) if not already enabled.
2. Check for signs of compromise in the mailbox In Outlook on the web (Outlook.com):
   1. Review Sent Items and Deleted Items for messages that were not sent personally. Large volumes of suspicious mail are a common sign of compromise.
   2. Check Settings → Mail → Rules for any suspicious Inbox rules (for example, rules that move messages to Junk Email, Notes, RSS Subscriptions, or that forward mail to unknown addresses). Delete any rules not created personally.
   3. Check Mail → Forwarding and remove any external forwarding addresses that are not recognized.
   4. Review the email signature for any suspicious content (for example, fake banking or scam signatures) and remove it if present.
3. Investigate and stop ongoing abuse If using Microsoft 365/Exchange Online with admin access:
   1. Use the Microsoft Entra admin center and Microsoft Defender portal to review sign-in logs and audit logs around the time the suspicious activity started (IP addresses, locations, times, success/failure) to confirm unauthorized access.
   2. Use Message trace in the Defender portal to review messages sent from the account during the suspicious period.
   3. If any hidden or malicious Inbox rules are suspected, use PowerShell to list them, for example:

            Get-InboxRule -Identity "user\<id>" -IncludeHidden | Format-List
      

   4. If the account was used to send spam or high-volume email, it may be blocked from sending. After securing the account, remove it from the Restricted entities page in the Microsoft 365 Defender portal as described in the outbound spam remediation guidance.
4. Respect sending limits and wait for reset If the account has exceeded sending or recipient limits (for example, thousands of recipients per day), sending will be restricted temporarily. After securing the account and stopping the spam, it may be necessary to wait up to a day (or until restrictions are cleared by the service) before normal sending is fully restored.
5. Prevent future compromise
   1. Ensure all devices used to access the account are scanned for malware and kept up to date.
   2. Keep multi-factor authentication enabled and avoid reusing passwords from other services.
   3. Follow Microsoft’s recommended security best practices for Microsoft 365/Outlook.com accounts.

If unable to complete these steps or if access to the account is lost, use Microsoft’s official account recovery and support channels to regain control and then follow the compromised-account remediation steps.

---

References:

• Respond to a compromised cloud email account
• Common symptoms of a compromised Microsoft 365 email account
• Fix NDR error "the sender's submission quota was exceeded" in Exchange Online
• NDR error code "550 5.1.8 Access denied, bad outbound sender"
• Sending limits in Outlook.com
• Hacker set up continuous draft ransomware email - Microsoft Q&A
• My account got hacked. - Microsoft Q&A
• My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
• Need to speak to a agent I am getting pop up draft scam emails - Microsoft Q&A
• Sender Support in Outlook.com
• I receive a 550, 553, or relay-prohibited error when sending email messages