PanicStation.org
UK USA
uk Technology & digital loss email sending blocked warning • outgoing mail blocked • unusual activity email account • suspected email compromise • email provider security alert • spam sent from my email • my email is rate limited • locked out of sending emails • email account flagged suspicious • mailbox rules changed • emails forwarding unexpectedly • filters i did not create • sign-in from new device • account security check • password may be stolen • third party mail app access • app password revoked • smtp sending blocked • unexpected emails from me • phishing warning email • email account takeover

What to do if…
your email provider warns it will block outgoing mail because of unusual activity

Short answer

Pause sending and secure your account by signing in via your provider’s official website/app (typed/bookmarked — not the alert link), then change your password and remove any suspicious forwarding/rules.

Do not do these things

  • Don’t keep retrying sends “until it works” — repeated attempts can worsen blocks and hide what changed.
  • Don’t click “fix/unblock” links in the warning email unless you reached the provider by typing the address yourself (phishing often imitates these alerts).
  • Don’t change lots of settings at random (signatures, DNS, mail apps) before you’ve checked for account takeover basics like rules/forwarding.
  • Don’t ignore it if you use this email for password resets or banking — email access is often the “master key”.

What to do now

  1. Stop outbound sending and access your account the safe way.
    Close email clients for a minute. Open the provider’s official app or type the provider’s web address directly, then sign in.
  2. Complete the provider’s security check / unblock flow (from inside the account).
    If prompted, verify it’s you, then change your password immediately to something new and unique.
  3. Check “recent sign-ins / security events” and sign out of other sessions.
    Look for logins you don’t recognise. Use “sign out of all devices” (or remove unknown sessions/devices) if available.
  4. Remove attacker persistence inside your mailbox.
    In settings, check and remove anything you didn’t set up:
    • Forwarding addresses
    • Inbox rules / filters that auto-forward, auto-delete, or mark mail as read
    • Auto-replies you didn’t write
    • Delegated access / shared mailbox permissions you don’t recognise
  5. Revoke third-party access that can send mail.
    In your account security/connected apps area:
    • Remove unknown apps and extensions
    • Revoke “mail access” permissions you don’t need
    • Remove app passwords if you don’t strictly need them
  6. Turn on two-step verification (2SV) and secure recovery options.
    Enable 2SV, then confirm your recovery email/phone are correct. Save any backup codes somewhere safe.
  7. Check your devices for malware (don’t install random “cleaner” tools).
    Update your computer/phone and run a scan using built-in or reputable security tools. If you suspect the device is compromised, do recovery steps from a different trusted device.
  8. If you think the warning email itself might be fake, report it.
    Forward suspicious emails to report@phishing.gov.uk (do this from your email client, not by clicking anything in the message).
  9. If spam may have been sent, warn key contacts once sending is restored.
    One short message is enough: “Ignore any unexpected emails/links from me recently — I’m securing my account.”
  10. If this is a work/organisation email, escalate internally immediately.
    Contact your IT/admin team so they can check sign-in logs, outbound sending spikes, and whether other accounts are affected.
  11. If money was lost or you shared sensitive details, report it.
    In England, Wales, or Northern Ireland, report cybercrime/fraud via Report Fraud. In Scotland, report to Police Scotland by calling 101.

What can wait

  • Writing long explanations to everyone — a short “ignore recent emails from me” is enough for now.
  • Deep clean-ups like changing every password everywhere — do the critical ones first (your email account and any accounts that reset via this email).
  • Deliverability/DNS work (SPF/DKIM/DMARC) unless your IT/admin says it’s needed — first confirm the account itself is secure.

Important reassurance

Providers flag or block outbound email for many reasons (new device, travel, automated sending, password reuse leaks). Once you’ve confirmed control and removed anything suspicious, sending can often be restored — but some providers may require an extra review step.

Scope note

These are first steps to regain control and prevent further misuse. If you discover fraud, impersonation, or workplace impact, you may need specialist help (IT/security, provider support, or reporting routes).

Important note

This is general information, not legal or professional advice. If you believe someone has access to your accounts, prioritise securing the email account and recovery methods first, and use official provider channels rather than links in messages.

Additional Resources
Support us