[UK] Recieved a phishing email.

A user reported receiving phishing emails, including one spoofed from their own email address, and noticed random unsent emails in their sent folder despite no malicious login attempts and multiple password changes.