Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If Gmail is sending messages you did not write or forwarding mail to an address you do not recognize, treat it as a possible account compromise. Change your Google Account password, run Security Checkup, disable automatic forwarding, remove unfamiliar forwarding filters, and inspect delegation, send-as addresses, POP3, IMAP, scheduled mail, sent messages, and connected apps. Stronger sign-in protection should be added after cleanup.
The goal is not merely to hide one suspicious address. You need to close every route that could let another person or service read, redirect, or send mail, then confirm that the Google Account itself is secure.
Start by securing the Google Account
Do not begin by deleting only the forwarding rule. An attacker who added that rule may also have read your mail, created filters, authorized an app, or changed recovery settings. Secure access first so a person or service cannot immediately recreate the Gmail changes.
- Change the Google Account password immediately. Use a new password that is not used on another site. Google’s Gmail security guidance says to reset the password immediately if you think someone has unauthorized access. Change it from a device you trust, especially if the suspicious activity is ongoing.
- Run Google Security Checkup. Review recent security activity, recovery phone numbers and email addresses, signed-in devices, 2-Step Verification, and account permissions. Remove anything you do not recognize. A recovery address or phone number you did not add can give an intruder a way back into the account even after you remove a Gmail rule.
- Keep the Gmail tab open only after you have secured access. If the account is controlled by an employer, school, or another organization, contact its administrator when settings are locked or unavailable. An administrator may control organization-wide routing, sign-in policies, audit information, or retention rules that are not visible in personal Gmail settings.
If you received a Gmail notice saying that forwarding was enabled and you did not enable it, Google’s guidance is to change the password immediately and turn off forwarding. Do not approve a forwarding confirmation simply because it appears in your inbox; first establish that the request came from an action you intended to take.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Record the suspicious forwarding address, filter names, message subjects, recipients, and approximate times before deleting anything. This information can help an administrator or Google’s recovery process understand what happened. Avoid forwarding suspicious messages to other people unless necessary, because doing so can spread private content.
Turn off Gmail’s automatic forwarding
Automatic forwarding is Gmail’s account-wide forwarding control. It is separate from filters, so disabling it does not remove a filter that forwards only selected messages. You must inspect both places.
- On a computer browser, open Gmail.
- Select Settings (the gear icon), then See all settings.
- Open Forwarding and POP/IMAP. Some accounts show a shorter Forwarding tab.
- In the Forwarding section, select Disable forwarding.
- Scroll to the bottom and select Save Changes.
Do not leave the page without saving. A change that appears on screen but is not saved will not close the mail route. After saving, return to the tab and verify that the disabled state remains.
Gmail may display a confirmation notice or require confirmation of a forwarding address when forwarding is first added. An address you do not recognize is a reason to continue with the account-security steps rather than simply removing the address. If an unfamiliar notice remains in the mailbox, check Sent, Trash, and other folders for related messages and preserve the details before deleting them.
Automatic forwarding can be legitimate for a second mailbox, an organization, or an archival workflow. If you recognize the address but no longer need the route, disable it anyway and document the change. If the route is required for work, ask the administrator to confirm the approved destination rather than re-enabling it on your own.
Find forwarding hidden inside filters
A filter can forward messages while the main Forwarding setting is disabled. Filters can also delete messages or skip the inbox, making it appear that mail is missing rather than forwarded.
- In Gmail on the web, open Settings and choose See all settings.
- Open Filters and Blocked Addresses.
- Review every filter, especially rules whose actions include Forward to, Delete it, or Skip the Inbox.
- Select Edit to correct a rule you created, or Delete to remove one you did not create.
Pay attention to broad criteria such as a filter with no meaningful search condition. A rule like that can affect a large portion of incoming mail. Also check for filters that automatically mark messages as read or archive them; those actions can hide evidence of a forwarding rule.
Do not assume a filter is harmless because its name looks ordinary. Review the search condition and every action on the edit screen. A rule may combine forwarding with deletion or inbox-skipping, allowing another party to receive a copy while you see little evidence. If you created a complex business rule, edit only the suspicious action and verify that the remaining workflow still works.
After deleting an unknown rule, test the mailbox with a legitimate message from a trusted account. Confirm that it appears where expected and that no approved forwarding workflow was unintentionally interrupted. A test cannot prove the account is clean, so continue with the other access checks.
Inspect Gmail’s other mail-access paths
Forwarding is only one way another person or service can receive or send Gmail messages. Review the following settings after disabling forwarding and removing unknown filters.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
| Pathway | Where to inspect it | What to look for |
|---|---|---|
| Send mail as | Accounts and Import | An unfamiliar address that can be selected as the sender of outgoing mail |
| Delegation | Accounts and Import → Grant access to your account | Another person granted permission to read or send mail |
| Mail retrieval | Accounts and Import → Check mail from other accounts (POP3) | An unknown external mailbox being collected into Gmail |
| POP/IMAP | Forwarding and POP/IMAP or the account’s equivalent tab | Access enabled for a mail client or service you do not use |
| Filters | Filters and Blocked Addresses | Rules that forward, delete, archive, or skip the inbox |
Remove an unfamiliar send-as address, delegation entry, POP3 account, or other access method. If you rely on a mail app or business workflow, identify it before disabling access so you do not interrupt a legitimate service. A recognized address can still be obsolete; remove it if you no longer control or need it.
Send mail as
An unknown entry under Send mail as can let someone compose mail that appears to come from another address associated with the account. Check the complete list, not just the default sender. If you see an address you did not add, remove it and investigate how the account was accessed.
Delegation
Delegation gives another person access to mail functions without sharing your password. Review every delegated account under Grant access to your account. Remove an entry you do not recognize, and confirm that former employees, contractors, or old personal accounts are no longer listed.
POP3 and IMAP
POP3 account checking can pull messages from another mailbox into Gmail, while POP or IMAP access can allow a mail client or service to interact with Gmail. An unfamiliar mailbox or enabled protocol is worth investigating. Disable access that you do not use, while documenting approved apps or devices so you can restore a legitimate connection deliberately.
Check whether Gmail actually sent messages
Open Sent and look for messages you did not write. Check Scheduled as well: an attacker may have queued mail that has not gone out yet. Cancel any unknown scheduled messages and record suspicious recipients, subjects, and times before deleting evidence.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review message details carefully. Unexpected recipients, unfamiliar wording, or a time when you were not using the account can help distinguish an unauthorized message from a delayed or automated message you previously scheduled. Also check replies and drafts for activity you do not recognize.
Ask trusted contacts whether they received unusual messages from your address. Unfamiliar sent mail, reports from contacts about strange messages, missing mail, and unexpected account changes are all signs that deserve a wider compromise check. Warn contacts not to open unexpected links or attachments from the suspicious messages.
Search Gmail for terms such as “forwarding,” “delegation,” or “security alert” to locate notices, but do not rely on inbox searches alone. A filter may have archived or deleted the relevant messages. Check Trash, All Mail, and any labels you use for security notifications. Missing messages can result from deletion, archiving, delegation, or a connected app rather than forwarding alone.
Review connected apps and sessions
A connected third-party app can access Gmail without using the Gmail forwarding control. In Google Account security settings, review apps and services with account access. Remove access for anything you do not recognize or no longer need. If you are unsure about an entry, identify the service through its official account page instead of approving it again from an unexpected email.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Also review recent sign-ins and signed-in devices in Security Checkup. Sign out of unfamiliar sessions where Google provides that option. A session on a device you recognize may still be stale or shared; change the password and confirm the device list after the password change.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Connected access can explain why a forwarding rule returns after you delete it. A service with permission may be recreating the rule, sending mail through an approved connection, or moving messages out of view. Remove the app’s access, change the password again from a trusted device if necessary, and then repeat the Gmail settings review.
If you cannot regain control, or the attacker keeps changing settings, follow Google’s compromised-account recovery process and involve your organization’s administrator when the account is managed. Do not promise yourself that deleting one message or one app has completed the recovery.
Protect the account after cleanup
Once the unwanted rules, access methods, and sessions are removed, add a stronger sign-in factor. This prevents many future unauthorized sign-ins, but it does not delete forwarding rules that already exist; those must be removed in Gmail settings.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Option | How it helps | Practical considerations |
|---|---|---|
| 2-Step Verification | Requires an additional verification step after the password | Review all enrolled methods and keep recovery methods available |
| Passkey | Uses a device-based sign-in credential instead of relying only on a password | Enroll it on a device you control and maintain a usable recovery method |
| Hardware security key | Provides a physical FIDO1 or FIDO2 second step for 2-Step Verification | Check the key’s connector or wireless compatibility with your devices; keep a backup key or another recovery method |
Google documents compatible hardware security keys, including its Titan line, as optional security-key choices. A key protects sign-in; it is not a tool for cleaning Gmail settings or stopping an existing forwarding rule. Choose based on FIDO capability, compatibility with your ports or devices, and whether you can maintain a backup. No particular model is required to remove forwarding.
After enabling a new factor, test the sign-in process while you still have access to your recovery methods. Keep recovery information current and private. If you lose the only second factor and have no usable recovery option, account access can become harder to restore.
What to do when a setting is missing
You are using the Gmail mobile app
Several administrative controls are easier to find, or available only, in Gmail’s desktop web interface. Open Gmail in a computer browser and use Settings → See all settings. If you only have a phone, use the browser’s desktop-site option where practical. The app can still help you review recent mail and security notices, but do not assume that an absent mobile control means the rule does not exist.
The forwarding tab has a different name
Google changes labels for some accounts and layouts. Look for Forwarding and POP/IMAP or a tab labeled simply Forwarding. The required action is Disable forwarding, followed by Save Changes. Interface labels can vary by account type and platform, so use the closest equivalent rather than stopping at the first mismatch.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchYou cannot change the setting
Work, school, and other managed accounts may restrict forwarding, delegation, POP, or security settings. Contact the administrator and provide the suspicious address, filter condition, message times, and any security-alert details. Do not create a personal workaround that sends organizational mail to an unapproved account.
The rule returns after you remove it
That usually means another access path remains active. Change the password again from a trusted device, remove unfamiliar connected apps and sessions, inspect delegation and POP3, and complete Security Checkup. Then remove the rule once more. If it still returns, escalate rather than repeatedly deleting it without checking the account behind it.
Messages are disappearing but nothing is forwarded
Inspect filters for Delete it, Skip the Inbox, archive, or automatic read actions. Check Trash and All Mail, and review delegation or connected-app access for a service that may be moving messages. A missing message is evidence of a mail-handling change, not proof that forwarding is the only problem.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Outgoing mail is not in Sent
Check scheduled mail, connected apps, and send-as addresses. A service using account access may send through Gmail without matching the workflow you normally use. Treat unfamiliar recipients or security notices as evidence for the broader account review. Ask recipients to preserve the original message details if you need to provide them to an administrator.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsA complete cleanup checklist
- Change the Google Account password.
- Complete Security Checkup and verify recovery details.
- Disable automatic forwarding and save the change.
- Delete or correct unfamiliar forwarding, deletion, archive, or skip-inbox filters.
- Review send-as addresses and remove unknown entries.
- Remove unfamiliar delegation.
- Inspect Check mail from other accounts (POP3).
- Review POP/IMAP access.
- Check Sent, Scheduled, Trash, and missing-mail symptoms.
- Revoke unrecognized connected apps and sign out unfamiliar sessions.
- Enable 2-Step Verification or a passkey; consider a compatible FIDO security key.
- Keep recovery methods available and contact an administrator for a managed account.
Work through the list in order. Password and account protection come first, Gmail routing controls come next, and stronger sign-in protection follows cleanup. Keep a short record of what you removed and when, especially if the account belongs to an organization.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When to escalate
Escalate to Google’s compromised-account recovery process if you cannot sign in, recovery details were changed, settings keep returning, or an attacker continues sending mail after the cleanup. For a work or school account, notify the administrator promptly because organization-level rules, audit logs, or retention controls may be outside your Gmail settings.
Escalation is also appropriate when you find unfamiliar connected services, repeated sign-ins, or evidence that sensitive messages were accessed. Provide the administrator or recovery process with the suspicious addresses, filter actions, dates, recipients, and security alerts you recorded. Do not delay password changes or leave forwarding enabled while waiting for a response.
Frequently asked questions
Does disabling automatic forwarding stop every forwarding rule?
No. Automatic forwarding and filter-based forwarding are separate controls. Disable the account-wide setting, then inspect Filters and Blocked Addresses for any Forward to action.
Why is Gmail sending email I did not write?
Possible explanations include unauthorized account access, a connected app, delegation, a send-as address, or scheduled mail. Check Sent and Scheduled, review account sessions and connected apps, and change the password immediately when the activity is unfamiliar.
Should I delete suspicious messages immediately?
First record subjects, recipients, times, forwarding addresses, and filter conditions. That information can help with account recovery or an administrator’s investigation. After recording it, remove messages or rules as appropriate.
Can a security key remove an existing forwarding address?
No. A FIDO-compatible security key is a sign-in protection factor. It can help prevent another unauthorized sign-in, but you must remove forwarding and filters in Gmail settings.
What if the suspicious address belongs to someone I know?
Confirm that you intentionally authorized it and that it is still needed. An address can be familiar yet outdated, compromised, or no longer approved for work. Disable it while you verify the legitimate workflow.
Free tools Windows power users keep installed
One-click scans. No signup required.
What if I cannot find the Forwarding tab?
Use Gmail in a desktop browser and look for Forwarding and POP/IMAP or simply Forwarding. Managed accounts may hide or restrict the control; contact the administrator if it remains unavailable.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Will changing my password delete filters?
No. Password changes protect account access but do not remove Gmail filters, forwarding settings, delegation, or connected-app permissions. Review and remove those separately.
How do I know whether an app is legitimate?
Review the connected-app entry in Google Account security settings and compare it with services you intentionally use. Remove unrecognized or unnecessary access, then reconnect only through the service’s official sign-in flow if needed.
Should I enable 2-Step Verification before deleting the rule?
Secure access first by changing the password and running Security Checkup, then remove the unwanted mail paths. Add 2-Step Verification, a passkey, or a compatible security key after cleanup so the existing rule is not mistaken for a resolved problem.
Recommended Free Tools
What should a business or school user do?
Follow the same immediate password and Gmail checks when permitted, but notify the organization’s administrator. Administrators may control forwarding, delegation, audit logs, recovery, or retention outside the individual mailbox.
Frequently Asked Questions
Does disabling automatic forwarding stop every forwarding rule?
No. Automatic forwarding and filter-based forwarding are separate controls. Disable the account-wide setting, then inspect Filters and Blocked Addresses for any Forward to action.
Why is Gmail sending email I did not write?
Possible explanations include unauthorized account access, a connected app, delegation, a send-as address, or scheduled mail. Check Sent and Scheduled, review account sessions and connected apps, and change the password immediately when the activity is unfamiliar.
Can a security key remove an existing forwarding address?
No. A FIDO-compatible security key protects sign-in. You must remove forwarding and filters in Gmail settings.
What if I cannot find the Forwarding tab?
Use Gmail in a desktop browser and look for Forwarding and POP/IMAP or simply Forwarding. Managed accounts may hide or restrict the control; contact the administrator if it remains unavailable.
Will changing my password delete filters?
No. Password changes protect account access but do not remove Gmail filters, forwarding settings, delegation, or connected-app permissions. Review and remove those separately.
What should a business or school user do?
Notify the organization’s administrator because forwarding, delegation, audit logs, recovery, and retention may be controlled outside the individual mailbox.
The Bottom Line
Unexpected Gmail sending or forwarding is a security warning, not just a settings nuisance. Change the Google Account password, complete Security Checkup, disable automatic forwarding, remove suspicious filters, inspect delegation, send-as, POP3, POP/IMAP, scheduled mail, connected apps, and sessions, then enable stronger sign-in protection. If control cannot be restored or the account is managed, escalate to Google’s recovery process or the organization’s administrator.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
