All E-Mail Sent To A Person Automatically Sends To An External Account - Hacked?

New Contributor

We have about a dozen people with mail accounts under Office 365.  Today whenever any of use send email to a specific person (within our company) they receive the e-mail, but the sender receives back the message below:

Thu 02-Aug-18


To send this message again, click here.


Delivery has failed to these recipients or groups:

The recipient's mailbox is full and can't accept messages now. Please try resending your message later, or contact the recipient directly.


It only seems to happen when the sender is within our company, not when sent from an external mail account.

I have checked the inbox rules on his account and there are no rules that would forward the e-mail to this external account.  I don't see any mail mail flow rules either.  How is this happening, how do I turn it off, and how did it likely get set up in the first place (I know that will likely just be that an account was hacked).


2 Replies

I found it.  It was under Admin->Active Users->User->Mail Settings->Email Forwarding


I was able to shut this off, but now have the question.  Is there any way to know when email forwarding was turned on?

Depends on how it was turned on (by the user himself or by an admin). In general, you can look at the Office 365 Audit log: Install-Module -Name MicrosoftTeams  -Repository PsGalleryInt