Mailbox rules can move, delete, forward or otherwise process messages based on conditions.
They are useful for normal workflow, but a compromised account can use rules to hide replies, suppress security notifications or forward sensitive conversations.
During account-compromise investigations, review rules along with delegates, forwarding and application grants.