When someone gets into a business email account, changing the password should happen immediately. But here’s the catch: once that’s done, the account still needs a full check, because other forms of access may quietly remain.
During the time they had access, the attacker may have created a forwarding rule, approved a connected app, added a sign-in method, or granted access to another account. They may also have a browser or email app that’s still signed in.
Email deserves particular care because it’s connected to so many other services. Password-reset messages for accounting software, cloud storage, social media, and other business systems often arrive by email. Someone who can still read the inbox may be able to reach those accounts too.
That’s why current recovery guidance from Microsoft, Google, and the UK National Cyber Security Centre includes several checks beyond changing the password. It’s also the kind of clean-up a good IT Support or Managed IT provider should handle properly, and not just with a quick reset.
Why a New Password May Not Remove Every Form of Access
Email services use sessions so you don’t have to enter your password every time you open a message. After you sign in, the service gives your browser or email application a cookie or token confirming the login has already been approved.
The service can continue accepting that session until it expires or is revoked. This means someone who signed in before the password changed may stay connected for a period of time, depending on the provider and the type of session.
Providers handle password changes differently. Google says that changing a password signs the user out in most places, but it lists exceptions that can include some devices and third-party applications. Google Workspace administrators also have separate controls for suspending an account and resetting its sign-in cookies.
Microsoft takes a similar approach for business accounts. Its guidance tells administrators to disable the affected account during the investigation and revoke active sessions separately.
The password change also leaves mailbox settings in place. A forwarding rule, delegate, or recovery method added while the account was compromised will remain until someone finds and removes it.
An Existing Session May Still Work
An active session is one of the first things your IT provider should check.
IMAGE SOURCE: https://www.pexels.com/photo/smartphone-screen-showing-account-verification-alert-33440144/
If the attacker signed in through a browser or email application, that session may still hold a valid token. Malware on an employee’s computer can also steal a session cookie and send it to someone else.
A stolen cookie may allow the attacker to use a session that has already passed the normal login checks. In that situation, they may not need to enter the new password at all.
The administrator should use the email provider’s tools to revoke the account’s active sessions and tokens. The exact name of the control varies between services. It may appear as “revoke sessions,” “reset sign-in cookies,” “sign out everywhere,” or “log out of all devices.”
If malware may be present on the employee’s computer, use another device to begin the recovery process. The affected computer should be checked before the employee signs in again.
Forwarding Rules Can Keep Sending Out Your Email
After closing the active sessions, check what was changed inside the mailbox.
An attacker can create a forwarding rule that sends a copy of every new email to another address. They may also use a filter that only forwards messages containing terms such as “invoice,” “payment,” “bank,” or “password reset.”
More selective rules are harder to notice, because most email continues arriving normally. The attacker only receives the messages they’re interested in.
Rules can also hide activity. For example, a rule may move security warnings, customer replies, or questions about a payment request into a folder the employee rarely checks.
Both Microsoft and Google tell users and administrators to check forwarding settings and mailbox rules after a suspected compromise.
Microsoft 365 administrators should perform this check through the administration tools, not only from the employee’s Outlook settings. Microsoft specifically recommends reviewing all inbox rules, including hidden ones.
A Connected App May Have Permission to Read the Mailbox
Forwarding rules are one way to keep receiving email. A connected application can provide another.
IMAGE SOURCE: https://www.pexels.com/photo/creative-photo-of-a-lock-key-16564254/
Businesses commonly connect email accounts to scheduling tools, customer management systems, mobile email apps, document services, and browser extensions. These connections often use OAuth.
When a user approves an OAuth request, the application receives permission to access certain parts of the account. The application doesn’t need to store the user’s password.
Attackers can misuse this process by creating an application that looks genuine and asking the user to approve it. Microsoft explains that a harmful app consent grant can provide access to email, files, contacts, and forwarding rules.
Some app connections may stop after a password reset, while others need to be removed separately. Review every application connected to the account and remove anything the business doesn’t recognise, use, or approve.
An application’s name and logo don’t confirm who created it. Your administrator should check the company behind it and the exact permissions it received.
Someone Else May Have Mailbox Permissions
Business email platforms allow one person to access another person’s mailbox. An executive may give an assistant access, for example, or several employees may work through a shared mailbox.
This type of access is called delegation. A delegate signs in with their own account, so changing the mailbox owner’s password doesn’t automatically remove the delegate.
Exchange Online supports Full Access, Send As, and Send on Behalf permissions. Gmail also supports delegated mailbox access.
Check every person and group with access to the mailbox. Confirm why they need it, and remove any permission that the account owner or administrator can’t explain.
Sending permissions need attention too. Someone with “Send As” access may be able to send messages that appear to come directly from the mailbox, even if they can’t read its contents.
Check Recovery and Sign-In Methods
The attacker may have added a phone number, recovery email address, authenticator app, passkey, or security key while they controlled the account.
A recovery method could help them regain access later. An authentication method might also allow them to approve another sign-in without knowing the new password.
Microsoft tells administrators responding to a compromised mailbox to review the user’s registered MFA devices and remove anything suspicious. Google also advises users to check recovery details, recent security activity, devices, and sign-in methods.
Compare every entry with the account owner. Remove anything that neither the employee nor the administrator recognises.
How to Secure a Compromised Email Account
Some of the settings involved are only visible through the business administration tools. Contact your IT provider or email administrator rather than asking the employee to handle the entire clean-up from their inbox.
Disable or Suspend the Account
The administrator may temporarily disable or suspend the account while checking it. They should also revoke active sessions and tokens so the attacker is signed out.
The employee may lose access for a short time, but leaving the account active gives the attacker more time to read, send, or delete email.
Change the Password
Set a password that hasn’t been used for another account. If the employee reused the old password elsewhere, those accounts need new passwords as well.
Do not send the new password to the affected mailbox. Use a phone call, an approved password manager, or another method your business trusts.
Some older applications use separate app passwords. Microsoft’s current guidance notes that these aren’t automatically revoked when the main password changes, so your administrator should remove or replace them if they’re present.
Review the Mailbox and Account Settings
Check forwarding addresses, inbox rules, filters, blocked addresses, delegates, sending permissions, signatures, automatic replies, and connected applications.
Then review the registered devices, phone numbers, recovery addresses, authenticator apps, passkeys, and security keys.
POP and IMAP access should also be checked. Some businesses still use these settings for approved email applications, so confirm how the account is used before disabling them.
Find Out What Happened
Once access has been removed, work out what the attacker did while they were inside.
Check the Sent, Deleted, Drafts, Junk, and Archive folders. Look for messages the employee didn’t write, replies they didn’t see, password-reset emails, and changes to payment instructions.
The administrator should review sign-in logs, audit records, email traces, and security alerts. Start the search before the first known warning, because the original compromise may have happened earlier.
A login from an unfamiliar location doesn’t prove that someone else used the account. Mobile networks, VPNs, and internet providers can affect location data. The device, time, IP address, application, and activity around the login provide more useful context when considered together.
Contact Anyone Who May Have Received a Fraudulent Message
If the account sent false messages, contact the recipients through a trusted channel. Tell them which messages weren’t genuine, and whether they need to change a password, delete a file, or ignore a payment request.
Pay particular attention to messages involving bank details, invoices, payroll, gift cards, or password resets.
If money may have been sent to the wrong account, contact the bank or payment provider immediately. Use a phone number from its official website or your existing records, not one found in the email conversation.
Secure the Account Before Returning It to the Employee
Once the unknown access, settings, and permissions have been removed, the administrator can return the account to the employee.
Require MFA before the employee signs in again. Where the email platform supports them, passkeys and physical security keys provide better protection against phishing than codes that can be entered into a fake login page.
MFA helps prevent another login with a stolen password. The earlier checks are still required, because MFA doesn’t remove existing forwarding rules, delegates, connected apps, or recovery methods.
How to Reduce the Risk of Another Compromise
Ask your IT provider to block automatic forwarding to outside addresses unless your business has a reason to allow it. Microsoft 365 and Google Workspace also provide controls for limiting which third-party applications employees can connect.
Require MFA for every email account, especially administrators and employees who handle payments or sensitive information. Use passkeys or physical security keys where the platform supports them.
Employees should report unexpected MFA prompts, unfamiliar login alerts, mailbox changes, and messages sent from their account that they don’t recognise. Report these signs as soon as they appear, so your IT provider can check the account before more email is sent or deleted. This kind of ongoing monitoring is exactly what a proper Managed Services setup should cover.
Frequently Asked Questions
Does Changing an Email Password Sign Out Every Device?
It depends on the provider. Some services sign users out of most sessions after a password change, while others provide separate controls for revoking sessions and tokens. Follow the account-compromise instructions for the email service your business uses.
Can Someone Still Receive My Email After I Change the Password?
Yes. A forwarding rule or filter may continue sending them copies of your messages. Check all forwarding settings and mailbox rules.
Can an App Access My Email Without Knowing My Password?
Yes. An app may receive permission through OAuth, which allows it to access approved account data without storing the password. Review and remove any connected application the business doesn’t recognise.
Should I Delete a Compromised Email Account?
The account is usually disabled or suspended while it’s secured and investigated. Deleting it could remove information your IT provider needs to work out what happened.
Is MFA Enough to Secure the Account?
No. MFA helps prevent new sign-ins, but it doesn’t remove mailbox rules, app permissions, delegates, recovery methods, or active sessions that already exist. Those need to be checked separately.
Sources and Further Reading
Microsoft: Respond to a compromised email account in Microsoft 365 — Microsoft’s step-by-step guidance for administrators.
Microsoft: App consent grant investigation — how harmful OAuth app consents are investigated.
Google Workspace: Identify and secure compromised accounts — Google’s guidance for Workspace administrators.
Google: Gmail security tips — Google’s account security checks for Gmail users.
UK National Cyber Security Centre: Hacked accounts — NCSC guidance on recovering a hacked account.
Australian Cyber Security Centre: Review your email account security — ACSC guidance on email account security.
Whether you’re running a small team in Mackay or a growing business across Brisbane, a hacked inbox is rarely just a password problem. It’s a clean-up job, and the sooner it’s done properly, the less damage there is to explain to clients later.
If you think someone still has access to your business email, contact your IT provider immediately. And if you’d like a proper review of your email security, check out our cybersecurity services, or get in touch with us and we’ll help you sort it out.
—
