{"id":19009,"date":"2026-10-22T21:02:30","date_gmt":"2026-10-22T18:02:30","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/recover-hacked-email-account\/"},"modified":"2026-10-22T21:02:32","modified_gmt":"2026-10-22T18:02:32","password":"","slug":"recover-hacked-email-account","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/recover-hacked-email-account\/","title":{"rendered":"Email Hacked or Sending Spam? Steps to Recover and Secure Your Mailbox"},"content":{"rendered":"<div class=\"hkb\" dir=\"ltr\">\n<div class=\"hkb-tldr\"><b>In short<\/b>If you receive bounces for messages you never sent, or customers say they got strange emails from you, your mailbox has probably been hacked. The steps in order: change the password from cPanel, then review forwarders, filters and auto-replies, because attackers leave them to keep reading your mail, then check your devices, then make sure your domain is not on blocklists.<\/div>\n<figure class=\"hkb-fig\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.hyyat.com\/zasogooh\/2026\/10\/hkb-hacked-email.webp\" alt=\"A hacked mailbox sending spam, then secured again after protection\" width=\"1200\" height=\"630\" loading=\"lazy\" \/><\/figure>\n<h2>Signs of a hacked mailbox<\/h2>\n<ul class=\"hkb-list\">\n<li>Lots of bounces for addresses you never wrote to.<\/li>\n<li>Messages in your Sent folder you did not write, or a Sent folder that is strangely empty.<\/li>\n<li>Customers asking about a message with a link or invoice you never sent.<\/li>\n<li>A hosting alert about high sending from your account, or sending stopped because you hit the limit. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/limiting-the-number-of-mails-sent-per-hour-in-whm\/\">hourly sending limits<\/a>.<\/li>\n<li>Your real messages now land in other people\u2019s spam folders.<\/li>\n<\/ul>\n<h2>Recovery steps, in order<\/h2>\n<ol class=\"hkb-steps\">\n<li><b>Change the password at once from a clean device:<\/b> From cPanel or the client area, not from the device you suspect. Choose a new long password. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/webmail-login-change-email-password\/\">changing your email password<\/a>.<\/li>\n<li><b>Review forwarders:<\/b> Attackers often add a hidden forwarder to copy all your mail to them. Delete any forwarder you do not recognise. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/cpanel-email-forwarders\/\">email forwarding in cPanel<\/a>.<\/li>\n<li><b>Review filters and auto-replies:<\/b> A filter that deletes or moves your customers\u2019 replies, or an auto-reply containing a scam link. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/email-autoresponder-cpanel\/\">auto-replies in cPanel<\/a>.<\/li>\n<li><b>Update the password on all your devices:<\/b> Phone, Outlook and any other app, so repeated failed logins do not get your own address blocked.<\/li>\n<li><b>Check your devices:<\/b> If the password was strong and never shared, it was probably stolen by an infected device or a phishing page. Run security software on your devices.<\/li>\n<li><b>Tell the people who received the messages:<\/b> A short note to customers saying scam emails were sent in your name and they should not click their links.<\/li>\n<li><b>Check your domain\u2019s reputation:<\/b> If a lot of spam was sent, the server address or your domain may be on blocklists. Open a ticket and we will check with you.<\/li>\n<\/ol>\n<div class=\"hkb-note w\"><b>Do not just delete the account:<\/b> deleting and recreating the mailbox is not enough if the password was stolen by an infected device, or if a malicious forwarder or filter remains elsewhere.<\/div>\n<h2>How to stop it happening again<\/h2>\n<ul class=\"hkb-list\">\n<li>A different password for each mailbox, never shared between staff. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/strong-password-password-manager\/\">strong passwords<\/a>.<\/li>\n<li>Never log in to email from a link in a message; open webmail by typing the address yourself. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/social-engineering-protect-your-team\/\">social engineering<\/a>.<\/li>\n<li>Enable SPF, DKIM and DMARC so nobody can spoof your domain from outside your server. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/what-is-dmarc\/\">what DMARC is<\/a>.<\/li>\n<li>Delete unused mailboxes; they are the ones hacked without anyone noticing.<\/li>\n<\/ul>\n<h2>Hacked versus spoofed<\/h2>\n<p>Sometimes customers receive an email showing your name that never left your account at all; it came from another server faking the sender. In that case you will find nothing in your Sent folder. The fix is not changing the password but setting up SPF, DKIM and DMARC for your domain.<\/p>\n<div class=\"hkb-hh\">\n<h2>How Hyyat Host helps<\/h2>\n<ul>\n<li>Hourly sending limits reduce the damage if an account is hacked, so it cannot send thousands of messages at once.<\/li>\n<li><strong>cPHulk<\/strong> and <strong>CSF<\/strong> block addresses that repeat failed email logins.<\/li>\n<li>If you see signs of a hack, open a ticket and we will help you review the sending logs and clear the mail queue.<\/li>\n<\/ul>\n<p style=\"margin:10px 0 0\">Learn more about <a href=\"https:\/\/www.hyyat.com\/en\/email-hosting\/\">email hosting<\/a>.<\/p>\n<\/div>\n<h2>Frequently asked questions<\/h2>\n<div class=\"hkb-faq\">\n<details>\n<summary>How did the attacker get my email password?<\/summary>\n<p>Usually from a phishing page, an infected device, a password reused and leaked from another site, or a short, guessable password.<\/p>\n<\/details>\n<details>\n<summary>My email suddenly stopped sending. Is it because of a hack?<\/summary>\n<p>It may be because the hourly sending limit was exceeded by spam sent from the account. Change the password and open a ticket.<\/p>\n<\/details>\n<details>\n<summary>Can the attacker read my old messages?<\/summary>\n<p>If they got into the account, yes. So review what sensitive information is in your mailbox, and change any passwords mentioned in it.<\/p>\n<\/details>\n<\/div>\n<div class=\"hkb-rel\"><b>Related guides<\/b><\/p>\n<ul>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/what-is-dmarc\/\">What Is DMARC and How to Stop People Spoofing Your Company Email, Step by Step<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/social-engineering-protect-your-team\/\">Social Engineering: How Attackers Trick Your Team Into Giving Away Passwords<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/webmail-login-change-email-password\/\">How to Open Webmail and Change Your Email Password<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/cpanel-email-forwarders\/\">How to Set Up Email Forwarding (Forwarders) in cPanel<\/a><\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hyyat.com\/en\/kb\/website-protection\/\">All website security guides \u2192<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>In shortIf you receive bounces for messages you never sent, or customers say they got strange emails from you, your mailbox has probably been hacked. The steps in order: change the password from cPanel, then review forwarders, filters and auto-replies, because attackers leave them to keep reading your mail, then check your devices, then make [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","footnotes":""},"doc_category":[2744],"doc_tag":[],"class_list":["post-19009","docs","type-docs","status-publish","hentry","doc_category-website-protection"],"year_month":"2026-10","word_count":689,"total_views":0,"reactions":{"happy":0,"normal":0,"sad":0},"author_info":{"name":"ahmed fathy","author_nicename":"ahmed-fathy","author_url":"https:\/\/www.hyyat.com\/en\/author\/ahmed-fathy\/"},"doc_category_info":[{"term_name":"Website Security","term_url":"https:\/\/www.hyyat.com\/en\/kb\/website-protection\/"}],"doc_tag_info":[],"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/19009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/comments?post=19009"}],"version-history":[{"count":0,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/19009\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/media?parent=19009"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_category?post=19009"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_tag?post=19009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}