If your infrastructure is actively sending abusive mail, stop or restrict the affected account, credential, application or relay path according to your incident process.
Then determine:
- which identity was compromised;
- when sending began;
- recipients/volume;
- source IP or application;
- authentication method;
- whether other credentials were exposed.
Reset or revoke affected credentials/tokens, remove persistence and fix the initial access.
Only after containment should you focus on blocklist/reputation recovery. Otherwise the abuse simply continues while you request delisting.