One of our co-workers followed a phishing link and entered their Google for Business account credentials. We have reset their password, is there anything else we need to do? (We also used this as a reminder for everyone to enable two factor authentication.)
The mail was also sent in their name to our staff mailing list (in BCC), so I assume it was also sent to other contacts in the address book. The headers indicate it was sent via Gmail, not from an external SMTP server (we have SPF records that only allow Gmail). Can we see who else got this mail, and is it useful to send a warning to them?