Email Account Hacked and Sending Spam? How to Lock Out the Attacker

Customers ring to say they got a strange invoice or a “shared document” link from your address. Your Sent folder has hundreds of messages you never wrote, or it is suspiciously empty. Replies from a client seem to have stopped arriving. Or your email provider has blocked you, and every message bounces with 550 5.1.8 Access denied, bad outbound sender or a notice that you have reached a sending limit.

That pattern means someone has signed in to your mailbox. This guide is about the email account itself: a Google Workspace or Gmail account, a Microsoft 365 or Outlook mailbox, or a mailbox at your web host. It is not about a hacked website; if your WordPress site is sending the spam or redirecting visitors, start with what to do in the first hour after a site hack instead. If nobody is in your mailbox but you are getting bounces for mail you never sent, someone is forging your address, and the spoofing and backscatter guide is the right page.

Work through the steps in order. The first three take about fifteen minutes and stop the damage. The rest clean up what the attacker left behind and get your mail delivering again.

What is happening

An attacker usually gets into a mailbox in one of three ways: a phishing page that copied your provider’s sign-in screen, a password reused from another site that was breached, or an old app or device that still signs in with a plain password and no second factor. Once in, they do some or all of the following.

What the attacker does	Why	What you notice
Sends phishing or spam from your account	Mail from a real, trusted address gets past filters and fools your contacts	Contacts complain; Sent folder full or emptied; provider blocks sending
Adds an inbox rule	Hides replies and bounce messages so you do not notice, often by moving them to RSS Subscriptions, Archive, Junk or deleting them	Replies and bounces vanish; a rule with a one-character name such as “.” or “..”
Adds forwarding to an outside address	Keeps a copy of everything you receive, even after you change the password	Usually nothing visible
Creates an app password or connects an app	A second way in that survives a password change on some providers	An unfamiliar entry in app passwords or connected apps
Changes recovery details or adds an MFA method	Lets them take the account back after you reset it	A recovery phone or email you do not recognize
Watches for invoices	Business email compromise: they reply in an existing thread with “new bank details”	A client pays the wrong account

The important consequence: changing the password alone is not enough. Sessions that are already signed in can keep working, and forwarding and rules keep running whatever the password is. Microsoft says plainly that app passwords are not automatically revoked when you reset a password. You need to do every step below.

Before you start

• Use a clean device. If the password was stolen by malware on your laptop, a new password typed on that laptop goes straight to the attacker. Use a different computer or your phone for the password reset, and scan the suspect machine before using it again.
• Work out which kind of mailbox you have. Run dig example.com MX +short on your own computer (Terminal on macOS or Linux; on Windows use Resolve-DnsName example.com -Type MX in PowerShell). Replace example.com with your email domain. A host ending google.com means Google Workspace, outlook.com or mx.microsoft means Microsoft 365, and anything else is usually your web host or another provider. The email diagnostic tool shows the same in your browser.
• Know who the administrator is. For Google Workspace and Microsoft 365, an admin can do things the user cannot, such as resetting sign-in sessions and unblocking sending. For host mailboxes, the hosting control panel owner can.
• Do not delete the evidence yet. Take screenshots of rules, forwarding settings and unfamiliar sign-ins before you remove them. You may need them for your insurer, your bank or a report.

Step 1: Reset the password and end every session

Choose a new, long, unique password from a password manager. It must not be one you use, or have used, anywhere else.

Personal Gmail

Change the password at your Google Account, then open Security and review “Recent security events” and “Your devices”, signing out any device you do not recognize. Google’s hacked account help also tells you to remove any labels, filters or forwarding you did not set up. If the attacker changed your password or recovery details and you cannot sign in, use Google’s account recovery page from a device and location you normally use.

Google Workspace (admin)

In the Google Admin console open Directory, Users, select the user, reset their password, then under Security choose Sign-in cookies and Reset. Google’s admin help notes that resetting a password revokes the user’s app passwords and recommends resetting sign-in cookies as well. Suspending the user also resets their cookies, which is a reasonable emergency stop while you investigate.

Microsoft 365 (admin)

Microsoft’s own response guide starts by blocking the account, then resetting the password, then revoking sessions. In the Microsoft 365 admin center go to Users, Active users, select the person and use Block sign-in and Reset password. Do not send the new password by email, because the attacker may still be reading it. To revoke active sessions from PowerShell on your own computer:

Install-Module Microsoft.Graph.Users.Actions -Scope CurrentUser
Connect-MgGraph -Scopes User.RevokeSessions.All
Revoke-MgUserSignInSession -UserId USER@example.com

Run these in PowerShell on your own computer, not on a server. The first line installs the Microsoft Graph module for your user only (-Scope CurrentUser avoids needing admin rights on the PC); skip it if already installed. The second signs you in as an admin and asks only for the permission to revoke sessions. Replace USER@example.com with the compromised mailbox. Good output is True (or no error). An error about insufficient privileges means your account lacks the right admin role. Sessions can take a little while to drop everywhere, which is why blocking sign-in first is useful.

Mailbox at your web host (cPanel, Plesk, Enhance and similar)

Change the password in the control panel’s email accounts area, not just in webmail. Changing it there invalidates the old password for IMAP, POP3, SMTP and webmail at once. If your host offers a way to suspend login or outgoing mail for the mailbox (cPanel’s Manage screen for an email account has restriction options for receiving, sending and logging in), suspend outgoing mail now and turn it back on at the end.

After the reset, every legitimate device will ask for the new password. That is expected; update them one at a time once the clean-up is finished. If a device keeps prompting afterward, see mail apps that keep asking for a password.

Step 2: Turn on multi-factor authentication and remove back doors

Multi-factor authentication (MFA, also called 2-Step Verification) means a stolen password alone will not get anyone in again.

• Google: turn on 2-Step Verification in your Google Account under Security. Workspace admins can enforce it for everyone under Security, Authentication, 2-Step Verification.
• Microsoft 365: enforce MFA with Security defaults or Conditional Access in the Microsoft Entra admin center. Microsoft’s guide also says to review the user’s registered MFA methods and remove any the attacker added.
• Host mailboxes: most host mailboxes do not support MFA for IMAP and SMTP. Webmail may offer it. This is one reason to keep the password long and unique and to keep the panel login itself behind MFA.

Then remove the attacker’s other ways back in.

Check	Google	Microsoft 365
App passwords	Google Account, Security, App passwords. Google revokes them when you change the password; delete any that reappear.	Not revoked by a password reset. Remove them in the user’s security info, or block them by policy.
Connected apps with access	Google Account, Security, “Your connections to third-party apps and services”	Entra admin center, the user’s Applications, and Enterprise applications for apps users consented to
Recovery phone and email	Google Account, Personal info and Security	The user’s security info (My Sign-Ins)
Admin roles	Admin console, the user, Admin roles and privileges	Admin center, the user, Roles

Step 3: Find and delete forwarding, rules and delegates

This is the step people skip, and it is how attackers keep reading your mail for months. Check each place below. Delete anything you did not create, after taking a screenshot.

Gmail and Google Workspace

• Gmail on the web, Settings (the gear), See all settings, Forwarding and POP/IMAP: remove any forwarding address you do not recognize. Workspace users may not see this tab if the admin has hidden it.
• Filters and Blocked Addresses: delete filters that forward, delete, archive or mark as read, especially ones matching words like invoice, payment, bank, your accountant’s name or a client’s domain.
• Accounts (Accounts and Import): check “Send mail as” for an extra address, and “Grant access to your account” for a delegate you did not add.
• General: check the signature and vacation responder for anything inserted.

Microsoft 365 and Outlook

In Outlook on the web, open Settings, Mail, then Rules, and Forwarding. Look for rules with meaningless names, rules that move mail to RSS Subscriptions, Conversation History, Archive or Junk, and rules that forward or redirect. Microsoft notes that attackers create hidden rules that do not show in Outlook, so an admin should also check from Exchange Online PowerShell:

Connect-ExchangeOnline -UserPrincipalName ADMIN@example.com
Get-Mailbox -Identity USER@example.com | Format-List Forwarding*Address,DeliverTo*
Get-InboxRule -Mailbox USER@example.com -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward*,Identity
Get-MailboxPermission -Identity USER@example.com | Where-Object { $_.User -notlike "NT AUTHORITY*" }

Run these in PowerShell on your own computer after installing the ExchangeOnlineManagement module. Replace ADMIN@example.com with your admin sign-in and USER@example.com with the affected mailbox. The second line shows mailbox-level forwarding: a value in ForwardingSmtpAddress means mail is copied to an outside address, and DeliverToMailboxAndForward : False means the user does not even get a copy. The third lists every inbox rule, including hidden ones (-IncludeHidden); look at ForwardTo, ForwardAsAttachmentTo and RedirectTo. The fourth lists people with full access to the mailbox; the filter hides built-in system entries. Good output is blank forwarding and only rules and permissions you recognize. Remove a bad rule with Remove-InboxRule -Mailbox USER@example.com -Identity "RULE_IDENTITY", using the Identity value from the list, and clear forwarding with Set-Mailbox -Identity USER@example.com -ForwardingSmtpAddress $null.

Host mailboxes

• Control panel email Forwarders (cPanel: Email, Forwarders; Plesk: the mail account’s Forwarding tab): remove unknown destinations.
• Control panel Email Filters and Global Email Filters, and the filters or rules area inside webmail (Roundcube calls them Filters under Settings).
• Webmail Identities for a changed Reply-To address, which quietly sends your clients’ replies to the attacker.
• Autoresponders you did not set up.

Step 4: Check the sign-in logs to see what happened

Logs tell you when the attacker got in, from where, and whether other accounts were touched. You need this to decide who to warn and whether data was taken.

Provider	Where to look	What to look for
Personal Gmail	Google Account, Security, Recent security events and Your devices; in Gmail on the web, the Details link next to “Last account activity” at the bottom of the inbox	Unfamiliar devices, countries, or access types such as IMAP from places you have never been
Google Workspace	Admin console, Reporting, the audit and investigation area, Login log events (and Gmail log events where available)	Successful logins from unusual IP addresses, “suspicious login” flags, password and 2-Step Verification changes
Microsoft 365	Microsoft Entra admin center, the user’s Sign-in logs; Defender portal audit log	IP address, location, time, success or failure, client app (old protocols such as IMAP or SMTP are a red flag)
Host mailbox	Ask the host for the mail server authentication log for the mailbox; cPanel’s Track Delivery shows recent outgoing messages	Logins from unknown IPs, a burst of outgoing mail and when it started

Look back to the first suspicious event, not just the last few days. If logins show access to other services you sign in to with this address, treat those accounts as exposed too.

Step 5: Get sending unblocked

Providers stop a mailbox from sending when it suddenly sends a lot of mail, because that is the classic sign of a compromise. Only ask for the block to be lifted after Steps 1 to 3 are done, or the attacker will simply carry on.

Microsoft 365: Restricted entities

A mailbox that exceeds Microsoft’s outbound limits can still receive mail, but sending fails with 550 5.1.8 Access denied, bad outbound sender. An admin removes the block in the Microsoft Defender portal under Email & collaboration, Review, Restricted entities, by selecting the user and choosing Unblock. Microsoft asks you to secure the account first and suggests running its Blocked Sender History diagnostic, which shows the listing history and the sender’s MFA status. If you cannot unblock the account yourself, or it keeps getting blocked, open a Microsoft support case.

Google: sending limits

Gmail and Workspace accounts that hit a sending limit see “You have reached a limit for sending mail”. Google’s documented behavior is that the user cannot send for up to 24 hours, after which the limit resets on its own. There is no button to lift it. Use the time to finish the clean-up, and tell the people you need to reach to expect a delay or contact them another way.

Host mailboxes

Your host may have suspended outgoing mail for the mailbox or the whole account, or the server’s IP may now be on a blocklist, which affects every customer on that server. Tell the host what happened and what you have done. Expect them to ask for confirmation that the password was changed and forwarders removed. If the host suspended the whole hosting account, the guide on getting a suspended hosting account reinstated covers the conversation.

Step 6: Check blocklists and your domain’s reputation

A burst of spam can get the sending server’s IP address or your domain listed on public blocklists. If you are on Google Workspace or Microsoft 365, the sending IPs are theirs, so listings usually affect your account reputation rather than a public IP. If your mail goes out through your web host, a listing on the server IP can block legitimate mail for days.

• Check your domain and the sending IP with the email diagnostic tool. The IP of the server that sent a message is in the bottom-most trustworthy Received: header of a copy of the spam; ask a contact to forward one as an attachment.
• Follow checking blocklists and getting delisted. Request delisting only after the cause is fixed; most lists check.
• Read your DMARC aggregate reports for the next few weeks. They show which servers sent mail as your domain and whether it passed. The spoofing guide explains how to read them.

Bounces that arrive while you recover contain codes worth reading. Email bounce codes explained and the SMTP reply code cheat sheet decode them.

Step 7: Warn people and check what else uses this address

• Tell your contacts, from the cleaned account or another channel, that messages sent from your address during a stated window were not from you and should be deleted. Keep it short and do not include links.
• Warn anyone you invoice or pay. If the attacker had access to threads about payments, call clients and suppliers on a number you already have and confirm bank details have not changed. Business email compromise fraud often follows weeks after the break-in.
• Change passwords elsewhere. Your email address is the reset route for your domain registrar, hosting account, WordPress admin, bank and social media. Anyone who controlled the mailbox could have reset those. Check each, starting with the registrar and the host. If your domain’s nameservers changed without your consent, go to recovering a hijacked domain immediately.
• Check the website too if the same password or the same person’s computer was used for WordPress. Containing a compromised WordPress admin account covers that side.
• Personal data. If the mailbox held customer personal data, a data breach notification duty may apply depending on where you and your customers are. This is not legal advice; ask a qualified adviser promptly, as some deadlines are short and the rules vary by country.

If none of that worked

If spam keeps going out after you have reset the password, revoked sessions and removed rules:

• Check that it really comes from your account. Look at the headers of one of the spam messages. If it was never sent through your provider (for example, no Google or Microsoft servers in the Received: lines) it is spoofing, not a compromise. Use the spoofing guide and tighten DMARC.
• Look for another compromised mailbox. Attackers often phish the rest of the company from the first account. Check sign-in logs for everyone, and look for internal messages with “shared document” links sent from the first mailbox.
• Look for a compromised device or app. An infected PC, a phone with an old mail profile, or a script on the web server using the mailbox’s SMTP password will keep sending. Rotate the SMTP password used by your website (see WordPress not sending email for where it lives).
• Contact the provider’s support with: the mailbox address, the time the problem started in UTC, the steps you have taken, screenshots of removed rules and forwarding, suspicious IP addresses from the sign-in log, and the full headers of one spam message.

Keep a written record of what happened and what you changed, with times. The hack recovery checklist helps you work through the same ground for a website, and the Emergency Room page for hacks is the quick route if more than email is affected.

See also

• Someone is spoofing your domain
• Server IP or domain on an email blocklist
• Gmail, Yahoo or Outlook rejecting your email
• Setting up Microsoft 365 email correctly
• Setting up Google Workspace email correctly
• Scary emails about your website: which are real