experiencing a serious issue with my personal Outlook.com account. My account appears to have been compromised, and malicious draft emails are being created continuously, sometimes almost every second.

I am experiencing a serious issue with my personal Outlook.com account. My account appears to have been compromised, and malicious draft emails are being created continuously, sometimes almost every second.

The issue is visible directly in Outlook on the Web, so it does not appear to be caused by the Outlook mobile app itself.

I have already taken the following actions:

• Changed my Microsoft account password.
• Enabled MFA / two-factor authentication.
• Used Sign out everywhere / Force sign-out so all devices need to authenticate again.
• Reviewed recent sign-in activity and found multiple suspicious international sign-ins from locations I do not recognize.
• Removed multiple unauthorized Outlook inbox rules with randomly generated names.
• Verified that email forwarding is disabled and no unknown forwarding address is configured.
• Disabled IMAP access.
• Confirmed POP access is disabled.
• Revoked all third-party application permissions I could find.
• Removed/revoked applications and services connected to the Microsoft account.
• Completely removed Outlook from my iPhone and restarted the device.
• Confirmed that the malicious drafts continue to be created in Outlook on the Web while Outlook is not installed on the iPhone.
• Confirmed that the issue continues after removing the malicious inbox rules and revoking application access.

I found this Microsoft Q&A thread describing what appears to be a very similar issue:

https://learn.microsoft.com/en-us/answers/questions/5755825/malicious-draft-email-keeps-appearing

I followed the applicable troubleshooting steps mentioned there as well, but the drafts are still being generated.

At this point, the issue continues even after password reset, MFA, forced sign-out, removal of suspicious rules, removal of app permissions, and disabling POP/IMAP.

Has anyone found a solution to this, or is there a way to escalate this to Microsoft so the underlying Outlook.com account activity can be investigated?

The issue started overnight on 10 September 2026 and is still actively occurring.

I can provide screenshots of the suspicious sign-in activity, unauthorized inbox rules, and examples of the automatically generated draft messages if needed.