My hotmail account has been hacked, there is a draft blackmail sextation email being populated in drafts and then sent several times a minute in my inbox

A closely matching Hotmail case recommends deleting the associated item from Microsoft To Do, because removing only the visible Outlook draft may leave a synchronized task or flagged item behind.^1^

Remove the corresponding To Do item

Before deleting anything, save redacted screenshots showing the message, timestamps, frequency, and any cryptocurrency address. Do not reply, pay, open links, or download attachments.

1. Open Outlook.com in a desktop browser.
2. Select the To Do checkmark icon in the left sidebar.
3. Check all of these lists:
   • My Day
   • Tasks
   • Flagged email
   • Any unfamiliar custom list
4. Open every item containing the sextortion text and select the trash can in its detail view.
5. Return to Mail and delete the malicious draft.
6. Keep Outlook desktop/mobile clients closed—or temporarily remove this account from those clients—while monitoring Outlook.com in the browser.

Outlook.com/Hotmail flagged messages can synchronize into Microsoft To Do, where their subject and message preview appear as tasks.^2^ Deleting a task is supported from its detail view.^3^ This is a matching workaround, not proof that To Do created the item. If genuinely new drafts or sent messages continue afterward, another client, application, or session may still be writing to the mailbox.

A draft shown beside an Inbox message does not necessarily reside in the Drafts folder: Outlook can display a reply draft in the same folder as the original message.^4^

Account for the session-revocation delay

Because Sign out everywhere was already requested, do not repeat it immediately. Microsoft states that revocation can take up to 24 hours to sign the account out of browsers and apps.^5^

• If fewer than 24 hours have elapsed, keep all mail clients closed and test again after that window.
• If more than 24 hours have elapsed and new items are still being created or sent, treat this as an unresolved mailbox-write issue rather than repeatedly deleting the drafts.

An authorized application is technically capable of accessing Outlook mail when it holds appropriate mail permissions.^6^ However, the recurring drafts alone do not establish that an OAuth token or application is responsible—especially since app permissions have already been reviewed.

Check the device before changing the password again

Since the password was already changed, first scan any device used to access the account:

• If using Windows: open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.
• On macOS or another platform: install current operating-system security updates and run the full scan offered by trusted, current security software.

Microsoft’s compromised-account procedure places a full malware scan before a password change, so that a credential-stealing device does not capture the replacement password.^7^ If malware is found—or the password was changed from a device that may have been infected—clean the device and then change the password again from a known-clean browser.

Escalate continued creation to Outlook.com support

A personal Outlook.com/Hotmail user does not have the Microsoft 365 administrator audit workflow described for business and enterprise Exchange Online plans.^8^ Microsoft Support must investigate service-side information that is not exposed through Recent activity.

While signed in to Outlook.com:

1. Select Help from the top menu.
2. Search for recurring malicious drafts after account secured.
3. Scroll to Still need help?
4. Select Yes and submit the case.^9^

Include:

• The first and most recent UTC timestamps.
• Whether messages are merely displayed as drafts or actually appear in Sent Items.
• Whether creation continues with every local Outlook/mobile client closed.
• Whether it continues more than 24 hours after Sign out everywhere.
• Whether deleting the matching To Do item stopped the recurrence.
• Redacted screenshots and message subjects—never send Microsoft your password, recovery codes, or two-factor codes.

References

1. Malicious draft email keep appearing in my mailbox. - Microsoft Q&A
2. Using Microsoft To Do with flagged email from Outlook | Microsoft Support
3. [Classic Outlook](https://support.microsoft.com/outlook/calendar/create-tasks-with-to-do-in-outlook#view-your-tasks-and-calendar-in-classic-outlook)
4. Create and respond to messages in Outlook Web App | Microsoft Support
5. How to sign out of your Microsoft account everywhere | Microsoft Support
6. Use the Outlook mail REST API
7. How to recover a hacked or compromised Microsoft account
8. Use a screen reader to search for, export, and review audit logs in the Microsoft 365 compliance center | Microsoft Support
9. How to get support for Outlook.com