Dear Jim Roberts,
Thank you for posting your question to the Microsoft Q&A.
I am so sorry to hear that you are going through this. It is incredibly stressful to deal with a compromised account, especially when you are being bombarded with these demands after you have already done the hard work of changing your password.
I see that the answer provided by Q&A Assist generally covers account recovery, but based on your description of the "loop," it sounds like the hacker has left behind a hidden automation to keep bothering you. Even though you changed your password, their previous login session might still be active, or they may have created a rule to forward emails.
Here are a few additional steps you can take to clear those rules out and end the hacker's session
Step 1: Ensure a Complete Sign-Out
Even though you changed your password, sometimes the intruder's connection stays active for a little while
- Go to account.microsoft.com/security.
- Click Advanced security options.
- Scroll down to Sign me out
- Click Sign me out.
- Note: This forces every device (phone, PC, and the hacker’s computer) to ask for the new password immediately.
Step 2: Check for Hidden Rules
- Open Outlook.com on your PC (the web version is best for this).
- Click the Gear icon (Settings) > Mail > Rules.
- If you see any rules there that look unfamiliar or strange, please delete them.
- Also, check Mail > Forwarding just to make sure your email isn't being sent anywhere else.
Step 3: Check your Sent Folder
To understand if they are still in your account or just faking it, please check your Sent Items folder.
- Case A: If you see the ransom emails inside your Sent folder, the hacker did have access. Step 1 (Sign Me Out) will stop this immediately.
- Case B: If you do not see the emails in your Sent folder, but you received them in your Inbox, this is called Spoofing. The hacker is faking your email address to scare you. You are safe, and you can mark these emails as Phishing.
Step 4: Check Thunderbird Since you mentioned using Thunderbird, let's make sure everything is clean there too.
- Open Thunderbird and go to Tools > Message Filters. If you see anything named "." or "Update" that you didn't create, you can simply delete it.
I hope these steps help you regain control and stop those annoying emails. Please let me know if you have any other questions
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.