One O365 account daily being banned for spam

We have one user that every day gets put in to restricted users for a violation and we cannot see why.

This happens only to the one user whilst the other 40 users are OK,

She only sends about 100 emails a day out mainly sage invoices.

We have virus checked and malware check the computer and its found nothing on the pc

The email account is NOT on any other device and if I do mail tracking I can only see the emails she sends out.

How can I stop this account getting banned every so many hours by the Compliance and security section, it just says the account may have been hacked and that it has sent x amount of emails

any advice would be good

Thanks