Email Account appears to be hacked

[Pete-StAlbans]

Earlier today many people started getting email messages that looked like they were from my mum's account. They weren't from her. These were from her contact/address list.

On reply (that quite a few people* did) a different email address (almost matching my mum's name and Gmail.com) sent a further email (that second email made it more clear it was a scam). That's when most alerted her to the hack. 

Thing is...

Reset Account password, but she is still not receiving any emails and can't send any out from her PC, it appears someone is intercepting all her incoming emails. And occasionally replying albeit from that different but similar email address.

How do we recover the situation and get her emails only accessible by her again?

Is there a phone number to talk to someone to resolve this?

Any help greatly appreciated. 

[用心棒]

Follow the advice here My Virgin media email has been hacked | Virgin Media Help — in webmail make sure there are no unexpected rules listed under ≡ > Setting > Email > Filter Rules

-- 
I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more
Have I helped? Click Mark as Helpful Answer and solved, or use  Kudos to say thanks

[Pete-StAlbans]

Thank you that was very helpful. 

There was indeed a rouge auto forward on her email account. 

Deleted the forwarding, but how do we see the emails that have been forwarded? 

They are not in the inbox on the web mail. We want to check what has been stolen by the hacker.

[用心棒]

Alas by default the auto-forward rule's option Keep a copy of the message is not set so no copy exists; not even in the Trash folder AFAICS

[Pete-StAlbans]

Thanks. We have not been able to recover those missing emails that were auto forwarded. 

On another device we could still access the email account without entering the new password!!!

It appears close all sessions of the product only does that on the device that you are on. So other devices can still access the email account without needing the new password. They can't access the Virgin Media account, but still can annoyingly access the email account thus the hacker might still have access.

How can you force a closure of email access requiring new password? 

[Pete-StAlbans]

Apart from the steps detailed here https://www.virginmedia.com/help/security/why-is-my-virgin-media-email-hacked 

What else can I do to ensure the hacker no longer has access to my mum's primary ntlworld.com email account?