What you’re seeing
- Outgoing messages bounce with code 5.1.8 and a note about access being denied for a bad outbound sender.
- The user can still receive email but every message they try to send fails.
- Administrators received an alert that a user has been restricted from sending email.
- Contacts report receiving strange messages, phishing links or invoice requests from the user before the block.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The account was compromised and used to send spam or phishing, so Microsoft automatically restricted it.
- A sudden spike in outbound volume, such as a mass mailing from a personal mailbox, exceeded sending limits.
- Malicious inbox rules or forwarding were created by an attacker to hide their activity.
- A connected app or device using the account's credentials sent large amounts of mail.
- Outbound spam policy thresholds were set lower than the user's normal sending patterns.
Why it matters
A restricted sender is cut off from customers until the block is lifted, but the bigger concern is why it happened. In most cases the account was taken over, which means an attacker may have read mail, stolen data or sent fraudulent payment requests to your clients. Simply lifting the restriction without securing the account usually leads to a repeat, and further abuse can damage the reputation of your whole domain.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Was our account hacked?
Very often, yes. Microsoft usually restricts accounts after seeing spam-like activity, so we treat it as a possible compromise and review sign-ins, rules and recent activity.
Should we warn our customers?
If fraudulent messages were sent, it is usually wise. Once we know what was sent and to whom, we explain it in plain English so you can decide how to communicate.
Is the rest of the company affected?
The restriction applies to that one account, but an attacker may have targeted others. Checking for related suspicious activity is part of confirming the cause.