Managing personal Outlook.com account settings, security, and privacy
Sorry to hear that your account was compromised. Since you have already changed the password and used the option to sign out everywhere, there are a few additional things I recommend checking before trying to clean up the mailbox.
First, please be aware that Microsoft states that Sign out everywhere can take up to 24 hours to sign the account out of browsers and apps. Therefore, if you performed this recently, an existing session may not have been terminated immediately.
Once the account is secured, please sign in directly to Outlook.com in a web browser and check the following:
- Go to Settings > Mail > Rules and remove any rule that you did not create. An attacker may have created rules to move, delete, flag, or otherwise process messages automatically.
- Check Settings > Mail > Forwarding and make sure your email is not being automatically forwarded to an address you do not recognize. Also review Automatic Replies and any other settings that you did not configure yourself.
- Check your Microsoft account Recent activity and verify that there are no unfamiliar successful sign-ins.
Regarding the emails that keep returning after you delete or unflag them, please test this directly from Outlook.com in the browser rather than from an Outlook application or mobile mail app.
For the emails that the attacker deleted, open Deleted Items and select Recover items deleted from this folder. Microsoft states that items removed from the Deleted Items folder in Outlook.com are normally recoverable for up to 30 days. If the missing messages are no longer available there, they may unfortunately no longer be recoverable through the mailbox interface.
Please let me know what you found so I can help you further.