PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
your email account is sending messages or spam you did not create

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Treat the account as potentially compromised. Use the email provider’s official app or website to secure it, sign out other sessions, check for unfamiliar settings and enable two-step verification or a passkey where available.

Do not do these things

  • Do not reply to the unwanted messages or open links and attachments inside them.
  • Do not approve an unexpected sign-in or verification request.
  • Do not use an account-recovery link from an unsolicited email or message.
  • Do not reuse your new password on another account.
  • Do not assume that changing the password alone removes every unauthorised session, connected app or forwarding rule.
  • Do not pay someone who contacts you unexpectedly and claims they can recover the account.
  • Do not spend time trying to identify who did this before securing the account.

What to do now

  1. On a device you trust, open the provider’s official app or type its website address yourself. Avoid links in messages about the incident.
  2. If you can still sign in, review the account’s recent security activity and note any unfamiliar devices, locations, recovery details or settings.
  3. Check the sent, deleted and draft folders, automatic replies, filters and forwarding rules. Note the basic details of anything unfamiliar and remove unauthorised rules or forwarding where the provider allows you to do so.
  4. Change the email password to a strong, unique password that you do not use anywhere else. If the service supports passkeys, consider setting one up through its security settings.
  5. Use the security settings to sign out other devices and sessions. Remove connected apps, delegated access or devices you do not recognise.
  6. Turn on two-step verification if it is available. Check that the recovery email address, phone number and verification methods belong to you.
  7. If you cannot sign in, start account recovery through the provider’s official support pages. Follow the provider’s instructions because recovery steps differ between services.
  8. Change the passwords on other important accounts where you reused the same or a similar password. Start with banking, shopping, cloud storage and social media accounts.
  9. Warn recent contacts through another trusted method that unexpected messages from your address may be unsafe. Ask them not to follow links, open attachments or act on payment requests in those messages.
  10. If this is a work, school or organisation account, contact its IT or security team promptly.
  11. If money was sent or financial details may have been exposed, contact your bank immediately using a trusted number, such as the number on your card or the bank’s official website.
  12. If you want to report suspected hacking or fraud, use Report Fraud in England, Wales or Northern Ireland. In Scotland, report it directly to Police Scotland.

What can wait

You do not need to identify the person responsible, determine the exact technical cause, reply individually to every contact or decide whether to change email providers now. Secure the account and protect connected accounts first.

Important reassurance

Unexpected sent messages can result from unauthorised account access, a connected app, an altered forwarding rule or someone imitating your email address. They do not by themselves prove that every device or online account you use has been accessed.

Scope note

This guide covers immediate account-security steps only. Checking devices for malicious software, assessing wider data exposure, investigating a workplace incident or recovering financial losses may require help from the provider, an IT specialist, your bank or the police.

Important note

This is general information, not personalised technical, legal or financial advice. Account menus, passkey support and recovery processes vary between providers. Use the provider’s official app, website or support pages for instructions specific to your account.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us