PanicStation.org
UK USA
uk Work & employment crises work email sending itself • emails sent i did not send • messages sent from my account • suspicious sent items at work • hacked work email account • work microsoft 365 compromised • outlook account compromise at work • gmail workspace account hacked • someone using my work inbox • unauthorised emails from me • unexpected email forwarding rule • mailbox rules changed without me • colleague says i emailed them • work account taken over • possible phishing stole my password • business email compromise signs • work chat messages not mine • teams or slack messages sent • account hijacked at work • compromised work mailbox

What to do if…
you notice emails or messages being sent from your work account that you did not send

Short answer

Treat this as a suspected account compromise: contact your IT/security helpdesk immediately and ask them to lock the account, force a sign-out, and check for suspicious sign-ins and forwarding/rules.

Do not do these things

  • Do not delete sent emails, security alerts, or logs — it can make it harder for IT to confirm what happened.
  • Do not keep using the account “to see what happens” or message the attacker back.
  • Do not click links or open attachments connected to this incident (even if they look internal).
  • Do not attempt password resets or “fixes” on a device you suspect might be compromised; if you have no alternative, call IT first and follow their instructions.
  • Do not send a mass apology/explanation to everyone yet unless your organisation asks — you could spread malicious links further or conflict with incident comms.

What to do now

  1. Pause and switch channel. Stop sending messages. Use a different trusted way to communicate (phone call, known helpdesk number, in-person) rather than replying from the possibly compromised account.
  2. Report it to IT/security immediately. Say: “I’m seeing emails/messages sent from my account that I did not send — please treat as suspected compromise.” Ask them to:
    • Temporarily disable/restrict sign-in
    • Force sign-out of all sessions
    • Reset your password and confirm MFA is enabled and working
    • Review recent sign-ins and any changes to mailbox rules/forwarding/delegated access/connected apps
  3. Preserve a minimal record (internally). Capture the minimum needed (timestamps, recipients, subject lines, any security alerts). Use screenshots only if allowed, and share them only through your organisation’s approved incident channel (not personal email or external services).
  4. Check for “silent” changes (only if IT says it’s safe to log in).
    • Look for unexpected forwarding, new inbox rules, auto-replies, or unknown delegate access/connected apps.
    • If you find something, capture the details and tell IT/security — don’t just delete it without guidance.
  5. Contain harm to colleagues/clients quickly.
    • Tell your manager (briefly) your account may have been used to send unauthorised messages.
    • With IT/security, identify who received the messages so the organisation can warn them not to click links or follow new payment/instruction changes.
  6. If invoices or payment details were involved, escalate internally now. Contact your finance/payments team (via a trusted route) so they can pause or verify transactions and supplier bank-detail changes.
  7. Secure related work access. If you reused passwords across work systems, assume they may be exposed. With IT guidance, update those credentials and ensure MFA remains on.
  8. If you suspect phishing started this, report the phishing safely. Use your organisation’s phishing reporting process. If (and only if) it’s permitted by policy and doesn’t disclose confidential company information, you can also forward the original phishing email you received to the UK’s suspicious email reporting address.

What can wait

  • You do not need to work out exactly how it happened right now — containment comes first.
  • You do not need to draft a detailed explanation to everyone who received messages unless your organisation directs it.
  • You do not need to decide whether this becomes an HR issue right now; focus on reporting and reducing harm.

Important reassurance

It’s normal to feel embarrassed or panicked, but this is a common attack pattern. Stopping use, reporting quickly, and preserving evidence are the actions that limit damage.

Scope note

These are first steps only. Your organisation may have additional security, HR, and data-protection steps once the account is secured.

Important note

This is general information, not legal or professional advice. Follow your employer’s IT/security policies and instructions. When in doubt, preserve evidence and report through approved channels rather than trying to “fix” it yourself.

Additional Resources
Support us