Sending, receiving, and organizing email in Outlook.com
Hello, thank you for reaching out to Microsoft Q&A.
There have been many reports of scam and spoof emails in Outlook similar to what you’re experiencing. This can occur if you’ve signed in to a fake or malicious website and someone has obtained your account details.
Please leave the draft as it is and follow the security steps below (reset your password, sign out of all active sessions, and enable two-step verification) to protect your account.
1. Reset your Microsoft account password.
Open an InPrivate/Incognito browser window and use the following link to reset your password: https://account.live.com/ResetPassword.aspx
2. Sign out of your account from all sessions.
Once the password reset is successful, sign in with your account here: https://account.live.com/proofs/Manage
Scroll down until you find Sign out everywhere. Select Sign out everywhere.
3. Enable two-step verification.
On the Security settings page, under Additional security, turn on Two-step verification. Make sure you have at least three security verification methods active.
After you have enabled these security protections, sign out of your account in the Outlook app and sign back in with your new password.
In addition to this,
Remove hidden email rules by going into Outlook for Web https://outlook.live.com/ > Go to Settings > Mail > Rules.
Delete all the rules. Then,
*open Microsoft To Do and delete all the drafts in the 'My Day' section or in the 'Task lists' where you see the drafts. To open To Do
In the https://outlook.live.com/ online, select ToDo in the left pane to launch it.
Click on a draft task and delete it.
Once done, wait for 48 hours and see if the draft email disappears.