The mail server at work will send you an email advising that your password has been changed and that you need to confirm this change. What if I find out that you haven't updated your password? When and why did the password change? Malware on which systems may have been used by an attacker to successfully change the password.

Determine which passwords are flawed and how to correct them.

Let's say your company's mail server sends you a message reminding you that you need to confirm the password change for your account. However, as far as you're aware, you didn't change the password! What may have caused the password to change? What kind of malware, and on what kinds of devices, may have given an attacker the details they required to change their password?

If the company's email server tells you of a password change, you must verify it. Passwords haven't changed yet. New passphrase. Why? If any virus gave an attacker password-changing data, what was it?