Sending, receiving, and organizing email in Outlook.com
Hello, thank you for reaching out to Microsoft Q&A.
There have been many reports of scam and spoof emails in Outlook, similar to what you’re seeing. This can happen if you signed in to a fake or malicious website, and someone got access to your account details.
Just leave the draft alone and follow the security steps (password reset, sign out everywhere, and turn on two-step verification) to protect your account.
- Reset your Microsoft account password.
Open an InPrivate/Incognito browser window and use the following link to reset your password: https://account.live.com/ResetPassword.aspx
If you already reset your passwrod,
2. Sign out of your account from all sessions.
Once the password reset is successful, sign in with your account here: https://account.live.com/proofs/Manage
Scroll down until you find Sign out everywhere. Select Sign out everywhere.
Doing this will sign you out of all the trusted devices where your account is signed in, possibly within 24 hours. Next,
3. Enable two-step verification.
On the Security settings page, under Additional security, turn on Two-step verification. Make sure you have at least three security verification methods active.
After you have enabled these security protections, sign out of your account in the Outlook app and sign back in with your new password.
The draft message in your inbox should disappear within 24–48 hours.
====================================================================
In addition to this, open Microsoft To Do and delete all the drafts in the 'My Day' section or in the 'Task lists' where you see the drafts. This may also trigger the drafts to appear in your Outlook inbox lists.
To open To Do
In the https://outlook.live.com/ online, select ToDo in the left pane to launch it.
Click on a draft task and delete it.