Learn how to identify signs of a compromised mailbox and take corrective action.
Problem description
The following signs may indicate that your account is compromised:
1. You receive an unusual logon alert.
2. You find abnormal logon behavior in the logon logs.
3. You find records of abnormal emails in your Sent folder, or a recipient reports receiving an abnormal email that you did not send.
Solutions
For employees
1. Check the Sent folder for emails that you did not send.
2. Use the log query feature to check the logon logs, received email logs, sent email logs, and deleted email logs for abnormal behavior.
For more information, see Log query on the web client.
3. If you receive an unusual logon alert by text message or email, check the logon time and location to determine whether it was you.
For administrators
1. Use the email revoke feature to find and revoke abnormal emails.
For more information, see How can a mailbox administrator revoke an email?.
2. Use the behavior query feature to check account logon logs and email logs for abnormal behavior.
For more information, see Behavior query.
3. Use the Data Statistics feature to view the number of emails sent and received by an account, and check the volume of emails sent during abnormal time periods.
For more information, see Data Statistics.
4. If you receive an unusual logon alert by text message or email, check the logon time and location to determine whether it was you.