Summary: Changing the password blocks someone from signing in with the old password. However, they may still have an active session, a forwarding rule, access through a connected app, mailbox permissions, or a recovery method they added.When someone gets into a business email account, changing the password should happen immediately. Once that is done, the account still needs a full check because other forms of access may remain.During the time they had access, the attacker may have created a forwarding rule, approved a connected app, added a sign-in method, or granted access to another account. They may also have a browser or email app that is still signed in.Email deserves particular care because it is connected to so many other services. Password-reset messages for accounting software, cloud storage, social media, and other business systems often arrive by email. Someone who can still read the inbox may be able to reach
