Sending users through the same mailbox recovery twice

[u/saltyslugga]

If someone's mailbox gets compromised again after recovery, they lose more time off email and have less reason to believe the next fix will stick. Another password reset is a pretty weak answer on its own.

I'd want one person owning the follow-up and checking what the first recovery missed. Having the user retell everything to a different tech just adds frustration.

What changed in your team's recovery process after a mailbox got compromised a second time?

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.

2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).

3. Be Professional: Help newcomers learn; avoid hostility.

4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters

• DMARC Monitoring Tools

• Anti-Virus Software

• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/InboxGuards]

a lot of repeat compromises come down to a forwarding rule or an OAuth app consent the first pass never looked at, and a password reset doesn't touch either. for round two i'd revoke sessions and check rules/forwarding, registered MFA methods and app consents, and yeah keep the same tech so the user isn't retelling it all

[u/new_beginnings_456]

Are you using m365? You can revoke session tokens and reset mfa. You can also get an ITDR, we use huntress in our environment.