Check whether an email account is sending authenticated spam

Receiving Mail delivery failed bounces for messages you don't recognise doesn't prove your password has been used. They may also be replies to messages sent by third parties with a forged sender.

Confirm the source

1. Find the messages in Track Delivery by sender, recipient and time.
2. Review the bounce's full headers, especially Message-ID, Received and the return address.
3. If you can't find a matching outgoing message, also check the time range covered by the logs. Its absence lets you consider spoofing, but on its own it doesn't rule out activity from before the retention period.
4. If the logs show authenticated SMTP or Webmail activity you don't recognise, treat the access as compromised. If they point to a local script, investigate the application too: it can send without using the mailbox password.

Contain unrecognised authenticated sending

1. From a trusted device, change the password to a new, unique and random one.
2. Update or revoke access in every client, phone, form and application that used the old password.
3. Review filters, forwarders, devices and connected applications. Scan your computers for malware, but don't take it as proven that the password leaked from one of them: it may also have been obtained through phishing or reuse.
4. In Email Accounts > Manage, check the sending restrictions. If there is held email, review it and delete the spam before allowing sending again; lifting the restriction may release pending messages.

If Track Delivery doesn't let you tell where it came from, contact support with the account, date, recipients and headers. Don't send the password.

Confirm that the sending has stopped

Review new events and any messages still held with support. Changing a password doesn't remove spam that was already queued, nor does it guarantee that every session is closed or that a vulnerable application is fixed. Check that no forwarders or filters added without authorisation remain and that legitimate sending still works before lifting a restriction.