Is Someone Still Reading Your Email? The 15-Minute Mailbox Audit

Figure 1 — Locked at the front, leaking at the back: why a password change is not enough, and the six doors this audit checks.

Evergreen Guide — Valid Through 2028. The six backdoors in this guide are features of how email works, not bugs of the moment — MITRE has cataloged the technique since 2020 and it still tops 2026 threat reports. UI paths verified against Google's and Microsoft's current settings, October 2026.

The Uncomfortable Truth About "I Changed My Password"

Here's the scenario, and it happens thousands of times a day in the US: you almost fell for it. A login page that looked exactly like Microsoft's. You typed your password. Ten minutes later you realized, went pale, and changed it. The confirmation email arrived, the little checkmark appeared, and the tightness in your chest released.

That feeling is lying to you.

A password change locks the front door. It does nothing about the copies of the key the intruder already made — and in email, there are six kinds of copies. The most common one is so ordinary-looking that it hides in plain sight: a forwarding rule, quietly mailing a copy of your incoming email to an address you've never seen, from a mailbox that looks completely normal.

This isn't a fringe tactic. MITRE — the organization whose framework US security teams literally operate by — catalogs it as its own technique (Email Forwarding Rule, T1114.003) and states it plainly: these rules "allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset." In Proofpoint's analysis of Q4 2025 account takeovers, roughly 10% of compromised mailboxes had a malicious rule created within moments of the break-in — the shortest recorded gap was about five seconds. Barracuda's 2026 Email Threats Report found a quarter of account takeover incidents involved suspicious inbox rule changes. And in a real incident documented by CISA, attackers went one step further: they created rules that moved any email containing phishing-warning keywords into the RSS Feeds folder — so the very alerts meant to warn the victim simply vanished from view.

This guide is the audit I'd want a family member to run after a scare. Fifteen minutes, a browser, and the settings you already own. It works identically from a phone, though the menus are easier on a desktop browser.

Station 1 — Silent Forwarding (2 minutes)

This is the classic, and the first place attackers go. A forwarding address means every email that arrives for you also goes somewhere else — password resets, bank statements, your sister's vacation photos, everything.

Gmail: open Gmail in a browser → gear icon → See all settings → Forwarding and POP/IMAP tab. What you want to see: Disable forwarding selected, and the forwarding-address list empty or containing only addresses you personally added.

Outlook.com: gear icon → View all Outlook settings → Mail → Forwarding. Same standard: off, or pointing only where you put it.

What counts as suspicious: any address you don't recognize, or a familiar-looking address with one character off (an r.n where there should be an m). Free email domains are normal; a Gmail or Outlook address you've never seen in your life is not — unless you genuinely set it up to back up your own mail.

If you find one: screenshot it, remove it, then check your sent mail and any folders like RSS Subscriptions for signs of how long it's been active. Don't stop here — an intruder rarely leaves just one door open. Keep going through all six stations.

Station 2 — Filters and Rules That Hide Things (3 minutes)

Forwarding is about reading your mail. Rules are about hiding from you. The pattern CISA documented — moving warning emails into RSS Feeds — lives here, along with its cousins: rules that mark everything as read, delete messages from your bank, or skip the inbox entirely.

Gmail: settings gear → See all settings → Filters and Blocked Addresses. Read every filter. Yes, all of them — most people have two or three; this takes a minute.

Outlook.com: gear icon → View all Outlook settings → Mail → Rules. Same drill.

The attacker signatures, straight from the threat reports:

• Rules with minimal, nonsensical names — a single period, three dots, a semicolon. Proofpoint found these are the most common naming pattern, because they look like glitches, not choices.
• From: yourbank.com, then: delete, or mark as read, or move to Archive / RSS Subscriptions.
• Conditions on words like invoice, payment, wire, phishing, hacked, password — with a delete or hide action attached.
• Anything marked-as-read on all incoming mail, which keeps your unread badge silent while replies to fraud pile up quietly.

Not every odd rule is malicious — you may have made one in 2019 and forgotten. You're the judge: if you can't remember creating it and can't imagine why you'd want it, it goes. Screenshot first.

Station 3 — Connected Apps You Never Approved (3 minutes)

Here's the backdoor most people have never heard of, and it's the one that survives a password change most comfortably. When you click "Sign in with Google" or "Continue with Microsoft" on some website, you're not just logging in — you're handing that site a token: an ongoing permission to read your email, sometimes indefinitely, without ever needing your password again. Changing your password does not revoke these tokens. Only you can, by hand.

Google: go to myaccount.google.com/permissions (or myaccount.google.com → Security → Third-party apps with account access). You'll see every app with access, what it can do, and when it was granted.

Microsoft: sign in at account.microsoft.com/security and review the apps and services connected to your account.

How to judge the list: expect the legitimate ones — your phone's mail app, a travel-booking site you actually use, a newsletter tool if you run one. The red flags are apps with broad access (read, send, delete, and manage your email), grant dates that match the period around your phishing scare, and names you can't connect to anything you've ever done. When in doubt, revoke — worst case, an app asks you to reconnect next time you use it, and now you know exactly which app that was.

Station 4 — App Passwords: The Spare Keys (2 minutes)

If you've turned on two-step verification (good!), some older apps and devices can't handle the second step — so Google and Microsoft offer "app passwords": one-time secondary passwords that bypass two-factor entirely. An intruder who creates one while inside your account keeps working even after you change the main password and re-enable 2FA.

Google: app passwords live under your Google Account's security settings. The healthy state is a short list of named, dated entries you recognize — "Mail on my old iPad," "Outlook 2016." Unnamed or recent entries you can't explain get revoked.

Microsoft: check the security area of your account for app passwords tied to your two-step setup.

Station 5 — Send-As, Delegation, and Connected Accounts (2 minutes)

The quieter relatives of the above, all worth sixty seconds each:

• Send mail as (Gmail: Settings → Accounts and Import → Send mail as): an attacker's address added here lets someone send email that appears to come from you. The list should contain only you (and aliases you made).
• Check mail from other accounts (same Gmail tab): this pulls other mailboxes into yours. Attackers occasionally use your mailbox as a collection point. Unfamiliar entries here are unusual and worth removing.
• Grant access / delegation (if your account shows it): lets another person read and send from your mailbox without any password at all. If you see a delegate you didn't add, that's as serious as a forwarding rule.
• Connected accounts (Outlook.com: Settings → Mail → Sync email): the Outlook equivalents — review who's connected, in both directions.

Station 6 — Recovery Info: The Door Back In (3 minutes)

The most patient intruders don't leave anything running. They change one thing: your recovery email and phone number. Then they wait. Weeks later, they hit "forgot password," receive the reset code at their address, and walk back into a locked house. This is why this station matters even when the other five came back clean.

Google: myaccount.google.com/security → review the recovery email and recovery phone under "Ways we can verify it's you." Then run Google's Security Checkup — it surfaces recent security events and devices in one screen.

Microsoft: account.microsoft.com/security → review your security info (alternate email, phone). Remove anything you don't recognize, and check the recent activity view for sign-ins from places you haven't been.

If you find recovery info that isn't yours: that's your answer — this wasn't a near-miss. Treat the account as compromised and move to the lockdown below.

The Decision Matrix — What Every Finding Means

If You Found Something — The Lockdown Order

Order matters here, and it's the opposite of what instinct says. Most people change the password first — but if you do that before revoking the backdoors, you're just informing the intruder they've been noticed, while their keys still work. Do it in this sequence:

1. Revoke everything first: forwarding, rules, connected apps, app passwords, unknown recovery info — all six stations.
2. Then change the password — from the trusted device, to a unique password you've never used anywhere else.
3. Sign out everywhere: Google and Microsoft both offer a "sign out of all devices/sessions" option in account security. Use it.
4. Then verify 2FA is on — ideally with an authenticator app or passkey rather than SMS, which sim-swappers in the US have learned to intercept.
5. Check what left your outbox: look in Sent Items and Trash for messages you didn't send. If any went to your bank, employer, or family — warn those people directly, by phone.
6. Then report it — the next section.

Report It — the US Chain That Actually Counts

If you found a backdoor, reporting feels like paperwork. It isn't: these reports are how the FBI and FTC see patterns, and a documented report strengthens your position with your bank if money was involved. The whole chain takes ten minutes:

• FBI — file at ic3.gov (Internet Crime Complaint Center). Attach your screenshots, the forwarding address, timestamps. This is the report US law enforcement actually works from.
• FTC — reportfraud.ftc.gov. Builds the federal fraud picture; takes five minutes.
• The phishing message itself — forward it as an attachment (not a normal forward, which destroys the evidence headers) to reportphishing@apwg.org, the Anti-Phishing Working Group. For dissecting those headers yourself — or understanding what the attacker's SPF/DKIM results were telling you — our Email Header Forensic Analyzer does it in the browser, free.
• Your provider — Gmail's "Report phishing" and Outlook's report button both feed provider-side blocking that protects the next person.
• Your bank or employer, if relevant — if wire transfers, payroll, or vendor invoices were anywhere near that mailbox, the fraud desk needs to hear it today, not after the audit report.

What This Audit Cannot Rule Out (Honest Limits)

Professionalism means telling you where the flashlight doesn't reach:

• Malware on your device reads your email locally — no mailbox setting will show it. If the device you read mail on has been throwing pop-ups, fake virus warnings, or strange slowness, that's a different audit: start with our guide to removing fake virus pop-ups on Windows 11.
• Server-side attacks — a breach of the provider itself or of a mail server you run — are invisible from your settings. If you administer your own server, our PHP2Shell patch and audit guide covers that side of the house.
• A delay-timed rule set to activate days after creation is rare but real — which is exactly why the clean result deserves a second audit a week later.
• Mail already read or exfiltrated before you found the rule can't be "un-read." What you can control is the door — and now it's closed.

What this guide also doesn't do: sell you anything, promise protection, or pretend a clean audit equals a clean bill of health. Fifteen honest minutes, six real doors, and a reporting chain that matters — that's the whole offer.

Make It a Habit, Not an Emergency

Run this audit twice a year — say, when you change your smoke-detector batteries — and after any phishing incident, even one you're sure you dodged. Pair it with three habits that stop most account takeovers before they start: a unique password per account (a password manager makes this painless), 2FA with an authenticator app or passkey, and a slow breath before any email that manufactures urgency — because urgency is the product being sold. For the domain-owners among you who worry about the other direction — your own domain being spoofed — we cover that in our SPF, DKIM and DMARC guide.

Key Takeaways

• A password change locks the front door; it does not revoke forwarding rules, connected apps, app passwords, or changed recovery info. MITRE documents this exact persistence technique (T1114.003).
• Attackers create hiding rules within seconds of a break-in (Proofpoint: ~10% of compromised mailboxes, ~5 seconds minimum; Barracuda 2026: 25% of ATO incidents).
• The six stations: Forwarding → Filters/Rules → Connected apps → App passwords → Send-as/Delegation → Recovery info.
• Revoke first, change the password second, sign out everywhere third. Order matters.
• A clean result earns a re-check in a week — not complacency.
• Found something? Screenshot everything, then file at ic3.gov and reportfraud.ftc.gov, and forward the phishing mail as an attachment to reportphishing@apwg.org.

FAQ — The 15-Minute Mailbox Audit

Related Guides — Internal Links (High Value Only)

• Email Spoofing: SPF, DKIM, DMARC — the other side of the coin: stopping your own domain from being spoofed.
• Email Header Forensic Analyzer Pro — our free in-browser tool for dissecting the phishing email itself.
• PHP2Shell: Patch and Audit Guide — if you run the server, that's your side of the perimeter.
• Remove Fake Virus Pop-Ups on Windows 11 — when the threat lives on the device, not in the mailbox.
• Recover Deleted Files on Windows 11 — the honest guide to file recovery, from the same series.

Sources & Verification