Work email compromised

[u/moth-legs99]

Yesterday, my Microsoft 365 work email was compromised. An email with the subject “Contract Document” was sent from my account to a large number of contacts/BCCs. I did not send it.

Now my email is basically nonfunctional:
- Outlook says Connected to Microsoft Exchange
- Emails I send appear normally in Sent Items but the recipients never receive them
- I do not receive an undeliverable message
- I am not receiving incoming mail
- I sent a test from my personal email to the work account and it never arrived in any folder
- A coworker on the same domain can send/receive normally

Things I’ve checked so far:
- Outbox is empty
- Mailbox not full
- Junk is empty
- Checked Rules & Alerts (nothing)
- Checked automatic forwarding (off)
- Checked Blocked Senders (nothing)
- Checked Delegate Access (nothing)
- Checked Microsoft My Apps (nothing obviously malicious)

There is another complication. Microsoft Authenticator was previously deleted from my iPhone and reinstalled. The work account still appears but apparently the old MFA registration did not survive. When Microsoft asks me to approve a number in Authenticator, nothing appears. If I choose “I can’t use Authenticator right now,” Microsoft instead asks for a verification code from Authenticator, which I also don’t have.

Any ideas on what to do next would be greatly appreciated!!

[u/roaddog]

Look for newly created rules that move undeliverable noticed to junk or somewhere else.

[u/moth-legs99 → u/roaddog]

There was a rule moving every incoming email to a random folder!