Account compromised with outlook rules

Multiple employees seem to have had their accounts compromised. Going to Outlook OWA it seems that there are rules set. Emails are being sent straight to the deleted items folder. I have talked to them and they claim that they didn't click on any suspicious links but we all know how that goes. I am trying to figure out the hacker's motive in sending emails into the deleted items folder. It seems like it could be a common thing. I have run anti-virus scans and nothing came up. There were google chrome extensions that seem to be out of the ordinary but could that be the root cause for password harvesting?