Messages you did not write in Gmail’s Sent folder, unauthorized sending settings, or a genuine alert about unusual sending activity deserve immediate attention. A friend seeing your address in a message is also worth investigating, but the displayed From address alone does not establish how the message was sent.
Contain the account access
From a trusted device, open Google Account directly. Change the password if you can, review recent security events, and identify unfamiliar sessions. If you cannot sign in, use Google’s compromised-account recovery route.
Do not wait to gather a complete archive before stopping active unauthorized access. Preserve a small amount of useful evidence, such as message times and the affected settings, without sharing private correspondence publicly.
Inspect sending and mailbox settings
- Look for messages in Sent that you did not compose.
- Check scheduled messages and the vacation responder.
- Review Send mail as identities and delegates under Accounts and Import.
- Check forwarding and filters, particularly rules that hide security notices or copy mail elsewhere.
- Review linked apps that have access to account data.
Remove unauthorized access and settings individually. Do not delete every legitimate mail rule or work integration indiscriminately; record what you change so that necessary settings can be reviewed afterward.
Do not rely on the password change alone
Google lists exceptions to the sign-outs caused by a password change. Review devices and authorized connections separately, and sign out unfamiliar sessions. A password change also does not remove a forwarding filter or undo messages already delivered.
If you reused the password elsewhere, change those passwords through the respective providers. Check important accounts that depend on this mailbox for password resets.
Check the device and warn affected people
Update the browser and operating system, inspect suspicious extensions, and use trusted security software if malware is suspected. Avoid entering a new password on a device you believe is still compromised.
If harmful messages reached contacts, warn relevant recipients through a trustworthy channel to disregard those messages. For a work or school account, notify the administrator so they can investigate organization mail and sessions. Do not send another mass message from an account that has not yet been secured.
Official references
- Secure a hacked or compromised Google Account
- Gmail security tips
- Change or reset your password
- See devices with account access
Reviewed against Google’s official guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.