Reset credentials, revoke sessions, remove malicious rules/forwarding, review sent items, alert finance, and preserve logs. Treat it as an incident—not a password ticket.
Want this applied to your environment?
Book a free 15-minute review. For a structured risk baseline, use ImpetraInsights™.