I just found out that my university email account has been forwarding all incoming messages to some random email I don’t recognize. I never set up any forwarding rules myself, and I only access my email through the official web portal. I changed my password right away, but I’m worried if that’s enough or if the attacker still has some kind of access. I checked the account’s security settings and didn’t see any unfamiliar devices logged in, but the forwarding rule is still active and I can’t delete it. I tried contacting the university’s IT helpdesk, but they said they’ll look into it tomorrow. Meanwhile, I’m concerned about sensitive info leaking out, especially with deadlines and personal stuff coming up. Has anyone dealt with unauthorized email forwarding like this? How did you manage to remove the forwarding rule or secure your account? Also, is it possible the attacker can still intercept my emails even after I changed the password?

That forwarding rule sticking around even after changing your password sounds like the attacker might have set it up at a deeper level - sometimes these rules are managed server-side and can’t be removed from the user interface. Since you don’t see any suspicious devices logged in, it could be that the attacker’s access was limited to setting that rule before you changed the password.

In the meantime, I’d recommend checking if your university’s email system offers any “revoke all sessions” or “sign out of all devices” option, which can sometimes help kick out any lingering access. Also, keep an eye on your sent folder and any other settings that might have been tampered with. Definitely keep pushing the IT helpdesk to prioritize this, because they might need to manually remove that forwarding rule on the backend.

One last thing: if you use that email for anything sensitive, consider alerting your professors or anyone expecting important emails that your account might be compromised,