I think someone hacked into my account and is forwarding my messages

Question

I keep getting a message that all messages I receive are being forwarded. I also have had some people tell me my mailbox is full and another email address is associated with it. How do I stop this?

Answer 1

If you suspect that your account has been compromised and someone is forwarding your messages, you should take immediate action to secure your account. Here are some steps you can follow:

1. Check for Suspicious Activity: Review your Sent Items folder for any messages that you did not send. If you find any, it indicates that your account may have been compromised.
2. Reset Your Password: Change your password immediately to prevent further unauthorized access. Make sure to choose a strong, unique password.
3. Review Mail Forwarding Settings: Check if there are any email forwarding rules set up that you did not create. You can do this by connecting to Exchange Online PowerShell and running the following command:

      Get-Mailbox -Identity <YourEmailAddress> | Format-List Forwarding*Address,DeliverTo*
   

   Replace <YourEmailAddress> with your actual email address. This will show if there are any forwarding addresses configured.
4. Remove Suspicious Forwarding Rules: If you find any suspicious forwarding rules, remove them immediately.
5. Enable Multi-Factor Authentication (MFA): If you haven't done so already, enable MFA on your account to add an extra layer of security.
6. Notify Your Email Admin: If you are part of an organization, inform your email administrator about the situation. They may need to take additional steps to secure your account.
7. Scan for Malware: Ensure that your devices are free from malware that could have compromised your account.

By following these steps, you can help secure your account and prevent further unauthorized access.

---

References:

• Respond to a compromised cloud email account
• Control automatic external email forwarding from cloud mailboxes

Answer 2

Check rules on a computer:

https://outlook.live.com/mail/0/options/mail/rules

Remove unwanted rules.

And check you account:

Microsoft account security info & verification codes