Account Security Problems

How to Fix a Compromised Microsoft 365 Account Sending Emails

John Wilson Sep 30, 2026 869 views

Question details

The user needs to recover a Microsoft 365 or Exchange account that has been compromised, is sending out unauthorized emails, and cannot be signed into because the Authenticator app is unavailable.

How to Fix a Compromised Microsoft 365 Account Sending Unauthorized Emails

Product: Microsoft 365
Device & OS: not provided
Scenario: A malicious actor has gained access to a Microsoft 365 account, is using it to send outbound spam or phishing emails, and the legitimate owner is locked out.
Observed behavior: Unauthorized emails are being sent from the account, and the legitimate user is unable to log in to stop it due to Microsoft Authenticator being inaccessible or altered.

Before you start

Immediately notify your contacts through an alternative method to ignore suspicious emails coming from your address, and disconnect your device from the internet if you suspect local malware infection.

Solution 1Recommended

Contact Your IT Administrator (For End Users)

If you are a standard user in an organization, your IT administrator has the privileges required to regain control of your account and bypass the broken Authenticator link.

End users cannot self-recover an account when the Authenticator app is unavailable and the account is actively compromised. Relying on an internal administrator is the fastest and safest recovery method.

Reach out to IT support

Contact your company's IT helpdesk or system administrator immediately using a phone call or an alternative secure messaging platform.

Request a password reset

Ask the administrator to log into the Microsoft 365 admin center and perform a manual password reset for your user account.

Revoke active sessions

Ensure your IT admin selects the option to 'Sign out of all sessions' to immediately disconnect the unauthorized user.

Reset MFA settings

Have the administrator clear your existing Multi-Factor Authentication (MFA) settings so you can securely re-register your Authenticator app upon your next login.

Contact Your IT Administrator (For End Users)

Tip: Once you regain access, check your inbox rules for any hidden forwarding rules that the attacker might have set up.

Solution 2

Contact Microsoft Data Protection Support (For Administrators)

If you are the sole administrator and your own admin account is compromised and locked out, you must contact Microsoft directly for identity verification and recovery.

Free Microsoft Office alternative

Discover WPS Office for Secure Local Document Management

While resolving your Microsoft 365 account security issues, you might need to continue working on your local files. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office that lets you manage, edit, and secure your documents locally.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install WPS Office: Run the downloaded setup file and follow the on-screen instructions to complete the fast installation.
3. Open Your Files: Double-click any existing Microsoft Office document to open and edit it securely in WPS Office.

Completely free and lightweight office suite for daily tasksFully compatible with Microsoft Word, Excel, and PowerPoint formatsFamiliar interface ensures a seamless migration with zero learning curveRobust local file encryption helps protect sensitive offline documents

microsoft office alternative - wps office

Frequently Asked Questions

Why is my compromised Microsoft 365 account sending emails on its own?

When hackers compromise an account, they often use it to distribute spam, malware, or phishing emails to your contact list and organization, exploiting the trusted reputation of your email address.

How can I check if the attacker created hidden forwarding rules?

Once you regain access, log in to Outlook on the web, click the Settings gear icon, navigate to 'Mail' > 'Forwarding' and 'Rules'. Delete any rules that you did not create yourself.

Can Microsoft community forums help reset my admin password?

No, community teams and forum moderators do not have the authorization or system access to reset administrator accounts. You must contact Microsoft Data Protection Support directly by phone.

Microsoft Office Security Issues