Check the account directly with the provider for unknown sign-ins, sent mail, forwarding and changed recovery details. Secure it from a trusted device; if locked out, use the provider's official recovery process.
Look for concrete changes
Messages you did not send, unexplained rules or changed security details deserve attention. One error message may have an innocent cause. Someone receiving mail that appears to come from you is not proof by itself: a visible sender can be forged. Check sign-in records and real account settings.
Secure all routes into the mailbox
- Change the password from a trusted device and replace it elsewhere if reused.
- Sign out other sessions and remove unknown devices and connected apps.
- Review forwarding, filters and recovery email addresses or phone numbers.
- Enable an additional sign-in method such as two-factor authentication or a supported passkey.
Your mailbox connects to other accounts
Many services send password reset links by email. Check important linked accounts for unfamiliar changes, starting with payment services. Warn contacts if false messages were genuinely sent from your account. If it is a work mailbox, involve IT. Keep relevant security notices while the events are being investigated.
A new password is only the start: check sessions, forwarding and recovery options too.
Sources and further help
The linked information supports this guide. It does not imply that these organisations work with or endorse MailMigo.