Record the discovery
Note what was observed, when and by whom, together with the displayed timezone and the account involved. Preserve the original alert or administrative export where feasible. A screenshot can support the discovery record but may not include the full underlying event data.
Sources that may help
Available sign-in, audit, rule-change, delegation and consent records may be relevant, together with affected messages and endpoint artefacts. Identify whether a rule was enabled, what it targeted and whether independent evidence supports actual forwarding. Current settings do not necessarily establish their historical state.
Containment and interpretation
Coordinate necessary account protection with the authorised incident team and record changes. This enquiry route does not provide continuous incident monitoring. An unfamiliar IP address or successful sign-in does not alone prove an intruder or identify a person. Log gaps can also limit reconstruction. A scoped examination can produce an event chronology, an assessment of the available evidence of account misuse and a list of unresolved questions. Begin with the platform, discovery time, response actions already taken and any urgent evidential deadline.