The short answer: Changing your email password stops a hacker from logging in with the old one. It does not automatically kick out a session that's already open, delete a forwarding rule they set up, disconnect an app they approved, or remove a recovery phone number they slipped in. Each of those has to be found and removed separately.

Picture this. You find out someone broke into your business email. You change the password in record time, breathe a sigh of relief, and get back to your day. Crisis averted, right?

Not so fast.

Changing the password is like changing the locks after a break-in. Smart move. But if the intruder also propped open a back window, copied your mailbox key, and filled out a change-of-address form so your mail goes to their place, new locks alone won't solve the problem.

People who break into email accounts rarely just look around and leave. They set things up so they can keep watching quietly. Here at Justice IT Consulting, we want every business owner in Dallas-Fort Worth to know this before it happens to them, because the cleanup is a lot easier when you know where to look.

Why your inbox is such a big target

Your email isn't just email. It's the master key to almost everything else in your business.

Think about where "forgot your password?" links get sent. Your accounting software. Your bank. Your cloud storage. Your social media. If someone can still read your inbox, they may be able to walk right into those accounts too.

That's why Microsoft, Google, and the UK National Cyber Security Centre all recommend a lot more than a password change when an email account is compromised. Here's what they're worried about, in plain English.

The 5 sneaky ways hackers stay in after you change the password

1. They're still "signed in"

When you log into email, the service hands your browser a kind of wristband, like the one you get at a concert. Once you've got the wristband, nobody checks your ticket again. That's what saves you from typing your password every time you open a message.

The catch? If the hacker got a wristband before you changed the password, it may keep working for a while.

Every provider handles this a little differently. Google says a password change signs you out in most places, but lists some exceptions, like certain devices and third-party apps. Microsoft tells business administrators to disable the account during the investigation and cut off active sessions as a separate step.

There's a nastier version too. Malicious software on an employee's computer can steal that wristband and hand it to someone else, who can then skip the login entirely. If that might be the case, start the cleanup from a different device and have the affected computer checked before the employee logs back in.

What to do: Have your IT provider use the "sign out everywhere" option for the account. Depending on the platform, it might be called "revoke sessions," "reset sign-in cookies," or "log out of all devices."

2. Your email is quietly being forwarded

This one is the digital version of that change-of-address form.

A hacker can create a rule that sends a copy of every new email to an outside address. The craftier ones get selective. They only forward messages that mention words like "invoice," "payment," "bank," or "password reset." Everything else arrives normally, so nobody notices a thing.

Rules can also be used to hide evidence. A rule might quietly move security warnings, customer replies, or "hey, did you really send this payment request?" emails into a folder nobody ever opens.

Microsoft and Google both say to check forwarding settings and inbox rules after a suspected break-in. For Microsoft 365, this check should happen through the admin tools, not just from the employee's Outlook. Microsoft specifically recommends reviewing all inbox rules, including hidden ones.

3. An app has a permission slip

Lots of businesses connect their email to other tools: scheduling apps, customer management systems, mobile email apps, browser add-ons. When you click "Allow," you're giving that app a permission slip to access parts of your account. Think of it like a valet key. The app never needs your actual password.

Hackers love this. They create an app that looks perfectly legitimate, then trick someone into clicking "Allow." According to Microsoft, a harmful app approval like this can give access to email, files, contacts, and even forwarding rules.

Some of these connections stop after a password reset. Others don't. Review every connected app and remove anything your business doesn't recognize, use, or approve. And don't trust a familiar logo. Your IT provider should check who actually made the app and what it's allowed to do.

4. Someone else has a key to the mailbox

Business email lets one person open another person's mailbox. An owner might give an assistant access, or a team might share an inbox. This is called delegation.

Here's the issue: a delegate logs in with their own account. Changing the mailbox owner's password doesn't touch them at all.

Microsoft 365 offers several levels of mailbox access, and Gmail supports delegation too. Check every person and group with access. If nobody can explain why someone has it, remove it.

Pay special attention to "Send As" permission. Someone with that access can send emails that look like they came straight from you, even if they can't read the inbox.

5. They added their own "Forgot password?" backdoor

While a hacker controls an account, they may add their own phone number, backup email address, authenticator app, or security key. That gives them a handy way to reset the password later or approve their own logins, no matter how strong your new password is.

Go through every recovery and sign-in method with the account owner. If neither the employee nor your IT team recognizes something, it goes.

Your email cleanup checklist

Some of these settings are only visible to an administrator, so this isn't a job to hand to the employee alone. Call your IT provider or email administrator and work through it together.

1. Lock the account and sign everyone out. Temporarily disabling the account feels inconvenient, but leaving it active gives the intruder more time to read, send, or delete email. Revoke all active sessions at the same time.

2. Set a brand new password. Make it one that's never been used anywhere else. If the old password was reused on other accounts, change those too. Don't send the new password to the hacked inbox (for obvious reasons). Use a phone call or a business password manager instead. And if the account uses older "app passwords," Microsoft notes these don't automatically stop working when the main password changes, so your IT team should remove or replace them.

3. Sweep every setting. Forwarding addresses, inbox rules, filters, blocked senders, delegates, sending permissions, signatures, automatic replies, and connected apps. Then the recovery side: phone numbers, backup emails, authenticator apps, passkeys, and security keys. Your IT team should also review older email connection settings (called POP and IMAP) and confirm whether the business actually uses them.

4. Play detective. Once the intruder is out, figure out what they did while they were in. Check the Sent, Deleted, Drafts, Junk, and Archive folders for messages the employee didn't write, password reset emails, and any changes to payment instructions. Your IT team should review sign-in history and security alerts, starting before the first warning sign, since the break-in may have started earlier than you think.

A login from a strange location isn't automatically proof of a hacker, by the way. Cell networks and VPNs can make locations look odd. The full picture (device, time, app, and what happened around that login) tells a much clearer story.

5. Give a heads-up to anyone who got a fake email. If the account sent fraudulent messages, contact those people through a phone number or channel you already trust. Be especially careful with anything involving bank details, invoices, payroll, gift cards, or password resets. If money may have gone to the wrong place, call your bank right away using the number on its official website, not one from the email thread.

6. Turn on multifactor authentication (MFA) before handing the account back. MFA means a second proof of identity, like a code or an approval on your phone, on top of the password. Where your platform supports them, passkeys and physical security keys are even better, because they can't be typed into a fake login page.

One important note: MFA prevents new break-ins. It does not undo forwarding rules, delegates, connected apps, or recovery methods that already exist. That's why steps 1 through 5 still matter.

How to make round two much less likely

The good news is that a few settings make a big difference:

  • Block automatic forwarding to outside addresses unless your business has a real reason to allow it.
  • Limit which third-party apps employees can connect. Both Microsoft 365 and Google Workspace have controls for this.
  • Require MFA on every email account, especially for administrators and anyone who handles payments or sensitive information.
  • Make it easy and normal for employees to speak up. Unexpected MFA prompts, unfamiliar login alerts, weird mailbox changes, or "I didn't send that" moments should be reported right away, no blame attached. Speed is your best friend here.

A quick note for defense contractors

If your business works on Department of Defense contracts and handles covered defense information or Controlled Unclassified Information (CUI), a compromised mailbox may be more than an IT headache. Under DFARS 252.204-7012, contractors must report qualifying cyber incidents to the DoD within 72 hours of discovery and preserve images of affected systems for at least 90 days.

In other words, don't delete anything, and don't wait until the cleanup is finished to get your compliance team involved. This is exactly the kind of situation where Justice IT Consulting helps defense contractors move fast without missing a requirement.

Frequently Asked Questions

Does changing an email password sign out every device?

Not always. Some providers sign you out of most sessions after a password change, while others require a separate "sign out everywhere" step. Follow the account recovery instructions for your specific email platform, or ask your IT provider to revoke all active sessions.

Can someone still receive my email after I change the password?

Yes. If a hacker created a forwarding rule or filter, copies of your messages can keep flowing to them after the password change. Have your IT provider check every forwarding setting and inbox rule, including hidden ones.

Can an app access my email without my password?

Yes. When someone clicks "Allow" on a connected app, that app gets permission to access parts of the account without ever needing the password. Review all connected apps and remove anything your business doesn't recognize or use.

Should I delete a hacked email account?

Usually not. The account is typically disabled while it's secured and investigated. Deleting it can erase the very evidence your IT provider needs to figure out what happened, and for defense contractors it may conflict with evidence preservation requirements.

Is MFA enough to secure a hacked account?

No. MFA helps block new logins, but it doesn't remove forwarding rules, app permissions, delegates, recovery methods, or sessions that already exist. Those all need to be checked and cleaned up separately.

Think someone still has a key to your inbox?

Don't wait to find out the hard way. If you think someone may still have access to your business email, contact your IT provider right away. If you don't have one, the team at Justice IT Consulting is here to help businesses across Dallas-Fort Worth and beyond. Book a discovery call with us and we'll help you figure out exactly where things stand.

Sources and Further Reading