Investigate Unauthorized Gmail Work Email

An unexpected message went out from our Google Workspace work account even though no one on the team composed or sent it. I want to understand exactly how that email originated, pinpoint the device or IP behind it using the Google Workspace activity log (which I can grant you access to), and then tighten our settings so the same situation cannot repeat itself.

Here’s what I need from you:
• Analyse the full message headers and Workspace audit logs to identify the originating source, authentication path, and any suspicious sign-in or delegated activity.
• Check filters, forwarding rules, third-party OAuth connections, and any mail routing rules that could have triggered an automated send.
• Provide a concise security report outlining your findings, the likely cause, and a step-by-step remediation plan.
• Walk me through the recommended changes—two-step verification enforcement, alert configurations, or admin console settings—so I can implement them immediately.

I can supply the raw email, header details, and log exports as soon as we start. Let’s get this incident fully diagnosed and our account locked down.