Account Breached, How?

Hello -   We had an end user who was breached and we found this out when the account sent out hundreds of emails.  The email was blocked automatically and we shut down the account, reset the passwo...