A mail forwarding rule is persistence that survives a password reset

Hidden forwarding rules keep exfiltrating mail after the account owner changes their password.