A hacked email account is sending spam: what to do

What it means

An attacker has logged in to one of your mailboxes, usually with a stolen or guessed password, and uses it to send spam or phishing. Typical signs:

• Hundreds of bounce messages for emails you never sent.
• Contacts telling you they got a strange email from you.
• Unknown emails in your Sent folder, or the Sent folder suspiciously empty.
• Your provider blocks your sending, or your IP or domain appears on a blacklist.

Why it matters

Every minute counts. The spam damages the reputation of your IP and domain, so even your normal emails go to spam. Phishing sent from a real account is also very convincing for your contacts.

How to fix it

1. Change the password from a clean device, not the one that may be infected. Use a long, unique password.
2. Turn on two-factor login (2FA) with an app or a security key.
3. Sign out every session. Google and Microsoft accounts have an option to sign out everywhere; admins can do it for users.
4. Remove what the attacker left. Check carefully:
   • forwarding addresses and inbox rules (attackers hide replies or forward everything);
   • delegated access, app passwords and connected apps you do not recognise;
   • the signature and the Reply-To address.
5. Scan the device used for email with up-to-date antivirus software.
6. Change the same password everywhere else it was used.
7. Unblock sending. In Microsoft 365, a user blocked for spam must be released by an admin in the Microsoft Defender portal ("Restricted entities"). Other providers may ask you to contact support.

If you run your own mail server

• Disable the hacked account until the password is changed.
• Look at the outgoing queue and delete the spam waiting in it, so it is not sent later.
• Check the logs to see which account or website sent the spam. A hacked website form or script is another frequent cause.
• Limit how many emails one account can send per hour.

Repair your reputation

1. Check blacklists for your sending IP and domain at /blacklists.
2. Request removal on each list only after the spam has stopped. If the IP is shared (Google, Microsoft, a newsletter tool), the provider handles it. Blacklist removal help is available in the paid Delivmail dashboard.
3. Warn your contacts briefly: tell them to ignore and delete the strange emails, especially any with links or attachments.
4. Watch your DMARC reports for a few weeks to spot any new unexpected sending.

Prevent it

• 2FA on every mailbox, especially admin accounts.
• Turn off old login methods (basic authentication, SMTP passwords) that you do not use.
• Teach your team to recognise fake login pages.

Check that it is fixed

The bounces should stop within a day. Send a test email from the Delivmail home page: the blacklist section should be clean and SPF, DKIM and DMARC should pass. If a listing remains, check it again a few days after your removal request.