Compromised Account

Hi @IniobongNkanga-8038

You could try to do all of the following steps to regain control of the account. Go through the steps as soon as you suspect a problem and as quickly as possible to make sure that the attacker doesn't resume control of the account.

1）Reset the user's password

2）Remove suspicious email forwarding addresses

3)Disable suspicious Inbox rules

4)Unblock the user from sending mail

5)Block the user account from signing-in

Reference:

https://video2.skills-academy.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide#secure-and-restore-email-function-to-a-compromised-microsoft-365-account-and-mailbox

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.