After changing the hacked password you needed to also check forwarding rules since emails would now be getting forwarded to your favorite spammer from Nigeria. This reminds me of accounts getting hacked when using Yahoo, AOL or Hotmail email and simple or the same password across platforms. Is the RSS Feeds folder in Office 365 actually accessible from outside parties? I was only successful in configuring external news RSS feeds to show in Outlook and was not able to find the setup parameters to link to someones Office 365 RSS Feeds. After deleting the rule and recovering the moved 96 emails we were unable to find the fishing email that created this rule in the first place. This is a server side rule and email folder RSS Feeds is not visible locally. This new rule named '.' forwarded all messages to RSS Feeds and then marked messages as read.

After repeated requests for follow-up emails we checked Office 365 Outlook and found a new forwarding all messages rule. Issue started yesterday at 3:30 PM when the user stopped getting new emails. Does anyone know about a hack that creates a forwarding all message to RSS Feeds rule in Office 365 Outlook?

Rss feeds in outlook 365