In my professional experience, this is not a common step from "hackers". However, I don't have any hard numbers to back that up, so I wouldn't take that statement as anything more than anecdotal evidence.
However, it's worth stating the obvious about why the hacker did this. What it really comes down to is that the attacker used this, effectively, as a hidden backdoor to continue to maintain access even after initial discovery. Indeed, this is what happened, as the attacker continued to get copies of all emails even after you reset the password on the email account. Working on the assumption that this attack scenario is less common, it suggest that this might be a more targeted attack, which is worth further scrutiny.
The fact that the hacker took this additional step means that they were interested not just in full access to the account, but that they were also interested in read-only access to incoming emails. There are three main uses I can think of for read-only access to a user's email:
1. Compromising further accounts
As long as they receive a copy of all emails, they can reset the password for any third-party accounts that the affected email address is registered with. After all it usually just takes that "reset" link to reset a password, and if they trigger a password reset they'll get a copy of the link too. They will no longer be able to delete the reset email in the original inbox, which might cause suspicion, but that won't stop them from resetting account access anyway - it just might mean they get caught quicker.
If you found out about the hack because the attacker used their access to break into other accounts, then this forward rule may simply be an attempt to extend their access and allow further "damage" even after the initial discovery. This is probably the least-painful scenario (for you).
2. Intercept business transactions (aka Mandate Fraud)
One scam I have heard of is attackers intercepting legitimate business transactions by having access to internal information from the billing team, typically for larger transactions. To pick a random example, imagine you were a roofing company and the person who owns this email address is on the billing team. They email a customer a $15,245.36 invoice and instruct them to send a check to your office. The hacker sees the same email and follows up to the customer a couple hours later with a spoofed email from the same email address (but with a different reply-to) that says, "Oh wait, there was a mistake in my last email. Please send that $15,245.36 to this address using this other payment method". This can be a very effective scam. By spoofing the same email address and injecting themselves into the conversation with full knowledge of the details of the transaction, it can be very easy to convince the person on the other end to simply do as instructed without even raising any red-flags.
If the email address belonged to someone on your accounting team, I might be worried about this kind of situation - such attacks definitely do happen.
3. Good old fashion snooping
It could be that the person wanted to have access to otherwise privileged information. This might be the case if, for instance, the compromised account belonged to someone in upper management. One example would be a lower level employee that had brief an unsupervised access to the managers computer. If the machine was left unlocked they could easily launch outlook and setup a forwarding rule in (probably) 30 seconds with practice.
I mention an employee simply because they are probably someone more likely to be "generally" interested in someone's emails without necessarily having a specific goal. While such an attack can generally be very easy to perform in an office environment, it's also obviously a bit risky, so it isn't on the top of my list of possibilities.
All this to say: personally I think this is less common, so I would be concerned that the attacker had a specific goal in mind for this particular account. I could be overly paranoid though. What this means is that it is worth considering exactly what an attacker might have to gain by continuing to have read-only access to this particular user's account. If they are someone with access to sensitive information about your company, I would be more worried.