Spam emails in my Sent Items through my school email

Question

Spam emails in my Sent Items through my school email

Sohaila Alahmady 20

I found hundreds of spam emails sent from my own school email address on Outlook. I already changed my password and has Multi-Factor Authentication, even though I found a lot of suspicious devices trying to log into my account no one succeeded and only my device is the one logged in. In addition there's no rules or forwarding or routing in my Outlook so I don't know what is the reason for all of that I don't even log in using my school email in anything and not sure what to do now

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi @Sohaila Alahmady,

Thanks for reaching out and good job already changing your password and confirming that MFA is enabled. Since you’re seeing hundreds of spam emails sent from your school address but no suspicious logins, rules, or forwarding, this often points to something at the tenant/admin level (e.g., compromised app permissions, spoofing, or a misconfigured connector) rather than just your individual password.

I strongly recommend you to:

1/ Contact your school’s IT admin / Microsoft 365 administrator

Ask them to:

Run an audit/log investigation in the Microsoft 365 compliance center to trace where the spam is actually originating from (your account, a compromised app, or external spoofing).
Check for suspicious app consents or OAuth apps that may have access to send mail on your behalf.
Review mail flow rules, connectors, and any tenant-level configurations that could be causing messages to appear as if they’re from your address.
Block or restrict the source of the spam from the admin side (e.g., block specific IPs, apps, or sending patterns).

2/ Ask the admin to consider changing your email address (if needed)

If the address has been heavily abused or is being widely spoofed, it can sometimes be easiest long-term for the admin to:

Disable or rename the current email address, and

Issue you a new school email address (e.g., a new alias or primary SMTP address), while migrating necessary data.
This is something only your school’s IT team can do, but it can stop ongoing abuse tied to that specific address.

3/ In the meantime

Keep MFA enabled and your password strong.
Avoid using the account on any third‑party sites or apps until the admin confirms it’s clean.
If you see any new suspicious activity, report it immediately to your school’s IT helpdesk.

Thank you for your patience and understanding.

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.