There’s a rule in your mailbox sending copies of your email to an address you don’t know.

Forwarding lives in two places, and they don’t list each other

In Outlook on the web, a forwarding rule and the forwarding switch are separate settings. Check both. Microsoft’s documentation says plainly that automatic forwarding “can also be set up in rules,” so an empty Forwarding page doesn’t clear the Rules page, and the reverse is also true.

1. Open Settings, then Mail, then Rules. Read every rule, including ones that look harmless.
2. Open Settings, then Mail, then Forwarding. See whether forwarding is enabled and which address it names. Note whether “Keep a copy of forwarded messages” is checked.
3. In Gmail, open Settings, then See all settings, then Forwarding and POP/IMAP. Google’s help page notes that a filter can forward some of your mail too, and says that when it does, the banner reads “and your filters are also forwarding some of your email.” Gmail shows a banner for the first week after forwarding is turned on, reading “You are forwarding your email to” the address. If you see that banner and you didn’t turn it on, treat it the same way.

What a normal result looks like, and what doesn’t

• Normal: no rules at all, or only rules you can name and remember writing. Forwarding off, or pointed at an address you can identify.
• Not normal: a rule that forwards, redirects, or forwards as an attachment to an address outside your company.
• Not normal: a rule that moves incoming mail to Notes, Junk Email, or RSS Subscriptions. Microsoft lists rules that move mail to these folders among the signs of a compromised mailbox.
• Hidden: some rules don’t appear in the screens above. An administrator can list every rule, hidden ones included, by running a command Microsoft documents. If you don’t administer your own Microsoft 365, this is the point to ask whoever does.

Before you delete it

Deleting the rule feels like the answer. Do these first, because after you delete it, the rule’s details are gone.

1. Write down the rule’s name, what it matches, and the exact address it sends to. Take a screenshot of the Rules page and the Forwarding page.
2. Turn the rule off instead of deleting it. Microsoft documents turning a suspicious rule off to stop it from processing messages while you investigate.
3. From a different computer than the one you normally use, change the password. If your administrator allows it, ask them to sign you out of all sessions.
4. Check the sign-in methods on the account for a phone number or app you didn’t add, and check which apps have been given permission to read your mail. Microsoft’s response steps list both, because they let someone back in after the rule is gone.
5. If you use an app password for an older program, replace it. Microsoft notes that app passwords aren’t revoked when the password is reset.

A new computer doesn’t remove it

The rule is stored with the mailbox, not on your computer. Microsoft’s documentation on rule-based attacks says that reinstalling Outlook, or giving the person a new computer, doesn’t help, because a fresh installation synchronizes all rules from the cloud.

What your administrator can see that you can’t

Microsoft 365 has an organization-wide setting for automatic forwarding to outside addresses, with three values: Automatic - System-controlled, On - Forwarding is enabled, and Off - Forwarding is disabled. Microsoft says the first value behaves differently from one organization to the next and recommends choosing On or Off explicitly. When forwarding is off, a blocked message bounces back to the sender with the code 5.7.520. If a customer reports that code on a message to you, your organization’s setting is doing its job.

That setting stops the copies from leaving. It doesn’t delete the rule. The rule stays in the mailbox until it’s removed. An administrator can also run the auto-forwarded messages report, which shows which accounts have been forwarding outside the organization.

What these checks can and can’t tell you

Finding a rule tells you where copies were sent after it was created. It doesn’t tell you how long it ran or which messages the other person read. Mail already forwarded can’t be pulled back.

When we look at this with you, we check rules (hidden ones too), forwarding, sign-in methods, and app permissions, and give you a dated list of what is set and what isn’t. A clean listing covers what we examined on that day.

The rule is how someone keeps reading your mail without signing in again, so it has to be found and written down before the password change means anything.

Related

• Replies to Customers You Never Wrote: Who Got Them
• Sign-In Approval Prompts on Your Phone You Didn’t Start
• Keeping Evidence Before You Clean Up a Computer
• MFA Is On: What the Second Step Covers and Misses

Sources

• Microsoft Learn: Respond to a compromised email account in Microsoft 365
• Microsoft Learn: Control external email forwarding and fix 5.7.520 errors
• Microsoft Learn: Detect and remediate Outlook rules and custom forms injection attacks
• Microsoft Support: Turn on or off automatic forwarding in Outlook
• Microsoft Support: Use rules to automatically forward messages
• Google Help: Automatically forward Gmail messages to another account