I think someone hacked into my account and is forwarding my messages

If you suspect that your account has been compromised and someone is forwarding your messages, you should take immediate action to secure your account. Here are some steps you can follow:

1. Check for Suspicious Activity: Review your Sent Items folder for any messages that you did not send. If you find any, it indicates that your account may have been compromised.
2. Reset Your Password: Change your password immediately to prevent further unauthorized access. Make sure to choose a strong, unique password.
3. Review Mail Forwarding Settings: Check if there are any email forwarding rules set up that you did not create. You can do this by connecting to Exchange Online PowerShell and running the following command:

      Get-Mailbox -Identity <YourEmailAddress> | Format-List Forwarding*Address,DeliverTo*
   

   Replace <YourEmailAddress> with your actual email address. This will show if there are any forwarding addresses configured.
4. Remove Suspicious Forwarding Rules: If you find any suspicious forwarding rules, remove them immediately.
5. Enable Multi-Factor Authentication (MFA): If you haven't done so already, enable MFA on your account to add an extra layer of security.
6. Notify Your Email Admin: If you are part of an organization, inform your email administrator about the situation. They may need to take additional steps to secure your account.
7. Scan for Malware: Ensure that your devices are free from malware that could have compromised your account.

By following these steps, you can help secure your account and prevent further unauthorized access.

References:

• Respond to a compromised cloud email account
• Control automatic external email forwarding from cloud mailboxes