Does this match what you’re seeing?
- You receive bounces for messages you didn’t send
- Contacts report spam or phishing from your address
- Sent folder contains messages you don’t recognise
First: is it really your account?
Bounces for mail you didn’t send, with nothing in your Sent folder, often mean someone is forging your address from elsewhere — not that your mailbox was accessed. SPF, DKIM and a DMARC policy make forgeries fail. SPF, DKIM and DMARC explained
Messages in your Sent folder you didn’t write, or recipients receiving mail that genuinely came from your server, mean the account itself is compromised. Continue below.
Secure the account
- From a clean device, change the mailbox password in E-mail Manager then E-mail Accounts. How to change an email account password
- Update the password in your own apps.
- Check any device where you log in to email for malware.
Check for what the attacker left behind
- Forwarders you didn’t create in E-mail Manager then Forwarders
- Autoresponders or vacation messages containing links
- Webmail filters forwarding or deleting messages
- Identities in webmail with a changed reply-to address
Find out how
- Did you enter the password on a login page from an email? Recognising phishing emails that pretend to be your host
- Was the password reused elsewhere? Strong passwords and password managers
- Is it saved on a shared or unmaintained computer?
Afterwards
- Check your domain and the server IP on blocklists. Email blacklists (blocklists): how to check and what to do
- If mail is being rejected, the bounces explain why. Understanding email bounce messages