PanicStation.org
UK USA
us Work & employment crises work email sending itself • emails sent i did not send • messages sent from my account • suspicious sent items at work • hacked work email account • microsoft 365 account compromised • outlook account compromise at work • google workspace account hacked • someone using my work inbox • unauthorized emails from me • unexpected email forwarding rule • mailbox rules changed without me • colleague says i emailed them • work account taken over • phishing stole my password • business email compromise signs • work chat messages not mine • teams or slack messages sent • account hijacked at work • vendor payment change email scam

What to do if…
you notice emails or messages being sent from your work account that you did not send

Short answer

Assume your account is compromised: contact your IT/security team immediately to lock access, force sign-out, reset credentials, and check for suspicious sign-ins and forwarding/rules.

Do not do these things

  • Do not delete the sent emails/messages, security alerts, or logs — it can destroy evidence your security team needs.
  • Do not keep using the account to investigate or warn people from inside the compromised account.
  • Do not click links/open attachments connected to this incident, even if they appear internal.
  • Do not try to “clean” your inbox or remove rules unless your security team tells you to.
  • Do not send a mass message to all recipients unless your security/communications team tells you to.

What to do now

  1. Pause and switch to a trusted contact method. Stop sending messages. Call your IT helpdesk/security team using a known number, or contact them in person/through an approved internal channel.
  2. Report it as suspected compromise and request immediate containment. Ask IT/security to:
    • Disable sign-in / lock the account until reviewed
    • Force sign-out of all sessions
    • Reset your password and confirm MFA is enabled and working
    • Review recent sign-in activity and any mailbox rules/forwarding/delegated access/connected apps changes
  3. Capture a small amount of evidence (then stop). Capture only what’s necessary (timestamps, recipients, subject lines, any alerts). If screenshots are allowed, share them only via your organization’s approved incident channel (not personal email or external services).
  4. Check the “silent persistence” settings (only if IT says it’s safe to log in).
    • Look for unexpected forwarding, inbox rules, auto-replies, or unknown connected apps
    • If you find something, document it and tell IT/security. Don’t just remove it without guidance.
  5. Contain harm to others fast.
    • Tell your manager your account may have been used to send unauthorized messages.
    • Work with IT/security to identify who received the messages so the organization can warn them not to click links or follow new instructions (especially payment changes).
  6. If invoices, bank details, gift cards, or wire instructions were involved, escalate immediately.
    • Contact your finance/AP team through a trusted channel to pause or verify transfers.
    • If money may have moved, your organization may also need to contact the relevant financial institutions quickly.
  7. Secure other work access. If any passwords were reused across work systems, assume they’re exposed. With IT guidance, update those credentials and keep MFA on.
  8. If external reporting is needed, follow your organization’s lead. If this looks like a business email compromise (especially involving payments), many organizations file a report with the FBI’s Internet Crime Complaint Center (IC3). Provide your incident handler accurate facts and avoid contaminating evidence.

What can wait

  • You do not need to prove whether this was malware, phishing, or a mistake right now — containment comes first.
  • You do not need to write a detailed explanation to clients/vendors unless your organization directs you.
  • You do not need to argue about blame or disciplinary implications in the moment; focus on rapid reporting and cooperation with the investigation.

Important reassurance

It’s common to feel embarrassed or panicked, but this is a known pattern of attack and it can happen quickly. Acting early — stopping use, reporting fast, preserving evidence — reduces harm.

Scope note

These are first steps to stabilize the situation. Your employer may have additional incident-response, legal/compliance, and communications steps after containment.

Important note

This is general information, not legal or professional advice. Follow your organization’s security policies and instructions. If money or sensitive data may be involved, escalate internally immediately rather than trying to handle it alone.

Additional Resources
Support us