We actually had something similar happen, almost to a “T”. Individual’s account was compromised and was used to send emails to their address book asking them t

We actually had something similar happen, almost to a “T”. Individual’s account was compromised and was used to send emails to their address book asking them to review an RFP. They would then delete the emails that were sent and the account owner was none the wiser. I am not 100% certain as to how the initial compromise happened, but it was an O365 environment and MFA was on. O365 did pick it up and send an alert, but due to a configuration error it did not disable the account. Anyways, it worked out and we transitioned to M365 as well.