[US] My email contact name changed, sent email with another email BCC’d

A user's father noticed his email's From: field displayed another person's name. A suspicious email in his sent folder, addressed to a university payroll employee and BCC'd to a Gmail account, requested a direct deposit update without providing bank details. The sender's email was changed back, and the password was updated.