Incident response

Office 365
Sending Spam

If a mailbox is sending spam, the account is almost certainly compromised. Immediate containment limits damage and protects your sending reputation.

Typical causes

  • Phished or leaked credentials
  • Weak or missing MFA
  • Legacy authentication protocols still enabled
  • Malicious inbox rules hiding attacker activity

Remediation steps

  • Contain the account and revoke active sessions
  • Remove malicious rules and forwarding
  • Assess scope across the tenant
  • Harden authentication controls
  • Verify sending reputation and blocklist status

Immediate response

What to do if your Office 365 mailbox is sending spam

If a mailbox in your organisation is sending spam or phishing emails, the account is almost certainly compromised. Speed of response directly limits the damage to your sending reputation and reduces risk to recipients.

If the account has been sending spam for more than a short period, Microsoft may have restricted outbound mail from your tenant. A broader review of authentication controls is usually required to prevent recurrence.

Get help

Email incident@iterik.ie or fill in the form below.

Prefer to talk first? Mention in the message box that you'd like a quick 15-minute phone or Teams call.

Common M365 email incidents