How do mail providers lock accounts post-compromise?

Providers detect compromise through: unusual sending patterns, spam reports from recipients, authentication from unusual locations, and automated abuse detection systems. Detection triggers protective actions.

Lockdown measures include: suspending outbound sending, requiring password change, invalidating active sessions, and temporarily blocking access. These prevent further abuse while investigation occurs.

Recovery process: verify identity through trusted channels, reset password, review and revoke unauthorized access, check for persistent threats (forwarding rules, connected apps), and investigate how compromise occurred.