Email Forwarding Settings Changed (Can Send Email, but not receive)

Has this happened to anyone else here?

First in July, then in October (today), I stopped receiving emails on 2 of 3 Cox.net accounts, but I could still send email.  I had a couple of calls with support and discovered that the Webmail interface settings were used to enable email forwarding on all three accounts.  Two accounts were set to delete the emails after forwarding them, which is why I was not receiving email.  The third account was set to forward all emails, but not delete them.  The emails were getting forwarded to some gmail.com account that I did not recognize.  We reported the gmail.com accounts to Google.  After removing the forwarding settings, we changed the passwords on all accounts.  The system notifies you on password changes, but not forwarding changes, so this can go unnoticed for some time.

Support, which was helpful and knowledgeable, believes that my passwords for these email accounts were compromised.  It's possible that a device, computer, or network contains a vulnerability that was exploited, but I've scanned everything and found nothing.  We apply updates and never open unknown attachments or links from emails.  I'm still not sure how this has happened twice, but am keeping a closer eye out for anything suspicious.  I use two other email accounts from different providers and those accounts have had no issues, only the cox.net accounts.

It doesn't hurt to check your forwarding settings if you suspect they may have been changed.