Is someone copying my messages?

Disable any unknown forwarding address or inbox rule in Outlook.com, then secure the Microsoft account if either an unfamiliar setting or sign-in appears.

Check whether messages are actually being forwarded

Use Outlook.com in a desktop web browser:

1. Select Settings (gear icon) → Mail → Forwarding and IMAP.
2. If forwarding is enabled to the unfamiliar Hotmail address, select Disable forwarding, then Save. ^1^
3. Go to Settings → Mail → Rules.
4. Examine every rule for an action such as Forward to, Forward as attachment, or Redirect to. Disable or delete anything you did not create. Outlook.com rules can forward or redirect all incoming messages while leaving the original messages in your mailbox. ^2^
5. Check Sent Items for messages you did not send.

If the failed-delivery notice contains the subject or contents of messages that you received, an automatic forwarding or redirect rule is the first setting to investigate. The notice alone, however, does not prove that someone accessed the account.

Secure the account if anything is unfamiliar

If you find an unknown rule, forwarding address, sent message, or sign-in:

1. On Windows, update the antivirus software and run Virus & threat protection → Scan options → Full scan → Scan now before changing the password.
2. Open the Microsoft account Security page and select Review activity.
3. Expand any sign-in you do not recognize and select This wasn’t me or Secure your account. ^3^
4. Change the account password to a new, unique password not used anywhere else.
5. Enable two-step verification and verify that all recovery email addresses and phone numbers belong to you.

Microsoft’s compromised-account procedure specifically recommends scanning the computer before changing the password, followed by reviewing account settings such as forwarding. ^4^

If no forwarding, rules, or suspicious activity exists

The messages may be backscatter: somebody spoofed your address as the sender, and failed-delivery reports were returned to you. That does not necessarily mean the mailbox was hacked, and such externally generated notices cannot be completely prevented. ^5^

Also verify that the notice is genuinely from the postmaster before opening attachments or following links. Microsoft notes that legitimate postmaster notices should still be checked because a postmaster message itself can be spoofed. ^6^

If the notices continue after forwarding and rules are removed and the account is secured, use Help in Outlook.com, enter the problem, and select Still need help? → Yes to contact Outlook.com support.

References

1. Turn on or off automatic forwarding in Outlook.com | Microsoft Support
2. Outlook.com
3. What happens if there's an unusual sign-in to your account | Microsoft Support
4. How to recover a hacked or compromised Microsoft account | Microsoft Support
5. Undeliverable emails from ******@outlook.com - Microsoft Q&A
6. Failed delivery messages from the postmaster at outlook.com, microsoft.com, or service.microsoft.com | Microsoft Support