Office365 account compromise

Hi, I'd start here, which is a series of steps, if you haven't seen it already, with how to deal with compromised accounts:

https://docs.microsoft.com/en-us/office365/securitycompliance/responding-to-a-compromised-email-account

The above article mentions checking the Audit Logs in the Security & Compliance Center and review all the activities for the suspected account

"by filtering the results for the date range spanning from immediately before the suspicious activity occurred to the current date"

The article also discusses checking the Azure AD Sign-in logs and other risk reports.