Confirm whether your account is hijacked or just spoofed
If the messages appear in your Sent folder and login history shows unknown access, your account is hijacked. If your Sent is clean, it's spoofing — different problem entirely.
Spoof vs hijack — quick test
- Sent folder empty + header shows a different domain → spoofing (no account access)
- Sent folder shows the messages + unfamiliar logins → hijacked (urgent)
- Both the display name and address match → almost always hijacked