Preventing auto send emails / drafts after hack

Question

Hello

I have had my personal microsoft account / outlook hacked. I have followed these steps to solve the issues:

• Change password
• Added 2FA
• Removed all forwarded rules
• Removed all apps attached to the account (including a suspicious one called Thunderbird)
• Checked aliases, there were none.
• Removed all devices
• Signed out everywhere
• Removed cache on all browsers used.
• Run virus checks on all the devices I use for trojans.

I am still having two issues which I can't work out:

1. A draft email keeps appearing at the top of my inbox (which is quite threatening)
2. Thousands of emails send each day until the sent messages limit has been reached.

I don't know what I am missing to fix these last two issues - I fairly confident that the account is now secure.

Does anyone have any advice?

Thanks

Answer 1

It sounds like you've taken significant steps to secure your account after the hack. However, the issues you're experiencing with a draft email appearing and thousands of emails being sent could indicate that there are still some lingering settings or rules that need to be addressed. Here are some suggestions:

1. Check for Suspicious Rules: Even though you mentioned removing all forwarded rules, it's important to double-check for any other rules that might have been created by the hacker. Go through your Outlook settings to ensure there are no remaining rules that could be causing the draft email to appear or sending out emails.
2. Review Sent Items: Look at the Sent Items folder to see if you can identify any patterns in the emails being sent. This might help you determine if there is a specific rule or setting causing this behavior.
3. Scan for Malware: Since you've already run virus checks, consider using a more comprehensive malware removal tool to ensure there are no hidden threats that could be causing these issues.
4. Contact Microsoft Support: If the problem persists, reaching out to Microsoft Support may be necessary. They can help you investigate further and may be able to identify any unauthorized access or settings that need to be corrected.
5. Monitor Account Activity: Keep an eye on your account activity for any unusual logins or changes. This can help you catch any further unauthorized access quickly.

By following these steps, you should be able to identify and resolve the issues with the draft email and the excessive sending of emails from your account.

---

References:

• Fix NDR error code "550 5.1.1" through "550 5.1.20" in Exchange Online
• Respond to a compromised cloud email account