Quick answer
An attacker may leave a forwarder, filter, or alternate access path even after a password is changed. Review the mailbox and account routing rules with the owner and preserve evidence before removing suspicious settings.
Before you start
Use a trusted device and authenticated account interface. Record the affected mailbox, incident time, and known authorized forwarding destinations. Limit the investigation to the account and data you are authorized to inspect.
What to do
- Capture the current forwarders, filters, autoresponders, and relevant account settings without exposing unrelated mail content.
- Compare each destination and rule with the owner's intended workflow, including rules that silently redirect or delete messages.
- Remove or disable only confirmed unauthorized access paths, change exposed credentials, and review other connected devices or application tokens.
- Test normal delivery and preserve a short incident record with the exact changes and any remaining investigation needs.
Check the result
Confirm that legitimate routing still works and that unauthorized destinations no longer receive new messages. Check both account-level and mailbox-level rules where the service exposes them.
If something does not work
Do not assume every unfamiliar rule is malicious or claim that a single check proves there was no data access. Contact support with concrete evidence and keep the scope of conclusions tied to what was verified.
Missing mail alone does not establish a compromise. If incoming messages are missing, follow the delivery checks alongside the rule review. If a destination is confirmed unauthorized, preserve its redacted details and contact support from the owning account before discarding evidence.
Related help
- Review who has access to your website and connected services
- Change a mailbox password and update every authorized device
- Resolve a full mailbox without losing important mail
- Collect useful evidence when an email message is missing
- Send a website support request with useful troubleshooting details
Official references
Reviewed October 31, 2026. Interfaces, vendor availability, and account features can change. Check your current account before making changes.
Symptom guidance and related-help review: November 1, 2026.
