I've seen this in our clients Microsoft365 and other accounts... it is when the USER is hacked and the hacker then setups up the forwards so They get all the emails going to them. The users in our case THOUGHT that they needed to reset a password or something on a site looking to be same, giving access to the account for the hacker to login and make changes. 90% of the time this has all to do with money scams. I bet, if you were to check the sent emails, in the accounts, you will find nothing sent from the hackers... but if you were to check the sent emails in the log files you will see they sent lots of emails.

I once caught the hackers off guard as I had another way to access a clients M365 account, logged them all off, change the passwords, etc. When I logged into those accounts I saw drafts of emails and sent emails (they hadn't deleted yet) all about adding themselves to banking accounts as signers!

I don't think SmarterTools would do this kind of thing. I've updated 2 mail servers to the newest build and haven't see rules built into those updates. 

I would advise your clients to change ALL their passwords to all their accounts... if it is not to late!

We had it only once on one account that had the password leaked. Someone did setup this by using the webmail. In this case the delete was not active, so it was a long time this way. Only when the gmail account was full, the senders did receive a NDR and we where asked to check what is happening.