What to do the moment you suspect an account is compromised

Change the password immediately, revoke all active sign-in sessions (Microsoft Entra admin centre or Google Admin console both offer "sign out everywhere"), and check for new mail forwarding rules or app permissions the attacker may have added. Then check sent items and mailbox rules for signs of what they did while inside.

Coach's tip: attackers often add a quiet forwarding rule to a personal address — check for that first, it's the most common calling card.