Staff Email hacked Restored but not able to receive any emails

You have two separate tasks: securing the compromised account and determining whether new messages reach Exchange Online. Restoring access alone does not remove attacker-created forwarding or inbox rules. First complete Microsoft's compromised-account response, including revoking sessions and reviewing authentication methods, app consent, mailbox forwarding, and hidden inbox rules. Preserve relevant evidence before removing malicious settings. For the missing test, confirm the actual recipient address and sender, widen the trace time range, and allow for trace ingestion before searching again. Microsoft documents a five-to-ten-minute delay for new messages. Obtain the sender's message ID and any non-delivery report. If no trace appears, investigate whether the sending system actually handed the message to Exchange Online. Separately check Deleted Items and Recoverable Items for missing mail; recovery depends on retention and holds. Escalate persistent mail-flow failures with the message ID and timestamps, rather than repeatedly restoring the account.