This is Outlook.com via the web, right? If so, click on the gear icon on the upper right, use this screenshot to guide you, so you know what location/icon to look for.
I also want to share a comprehensive list of action items, as I am seeing many of these questions lately, usually related to compromised accounts. Better safe than sorry.
Please complete these steps on a computer, not on a smartphone or tablet.
====================
First, go to https://www.outlook.com and sign in.
Click the gear icon in the top right corner to open Settings.
Under Mail, review the following areas:
Rules
If any rules are listed, delete all of them.
Conditional formatting
If anything is set up there, delete it.
Forwarding and IMAP
If you see any entries or settings you did not create, remove them. Turn off POP and IMAP.
Junk
Review Safe sender and blocked list. If you don't recognize any, remove them.
After that, exit Settings and return to outlook.com.
Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.
====================
Go to https://account.live.com.
Under Your info > Sign-in preferences, review all aliases on the account. If you see any alias you do not recognize, remove it.
Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.
====================
Please also do the following in Security section
Change your password
Enable two-step verification
====================
Go here https://account.microsoft.com/privacy/app-access Click on "Don't allow" for anything you don't recognize.
=======================
Then go to Security > Manage how I sign in and make sure all contact information belongs to you.
On that same page, scroll down to App passwords and remove any existing app passwords.
Also on the same page, click on Sign out everywhere. This is intended to disconnect any active sessions that may still be connected. Please note that this can take up to 24 hours to fully take effect.
====================
In addition, this problem can sometimes be caused by a malicious script or infection on one of your devices.
Then go to the Microsoft Safety Scanner download page:
https://learn.microsoft.com/defender-endpoint/safety-scanner-download
Download the 64-bit version, run a full scan.