Email is still a key business tool, but it is also a key method for attackers to take over systems and credentials. Microsoft’s Securing Office 365 blog has an excellent discussion of what attackers can do (and, in fact, do) through forwarding rules. The first step is to check if any malicious forwarding rules are set up that you are not aware of. The resulting rule will be branded as set by the Secure Score module so you can track what action enabled the rule and when the rule was enabled. When email is rejected, a notice will be sent to the sender.”]
Source: https://www.csoonline.com/article/3327204/how-to-stop-malicious-email-forwarding-in-outlook.html