Forwarded emails can expose threads with sensitive information.
One of the first things a skilled attacker does after gaining access to an email account is set a forwarding rule to an address they control. The rule is invisible during normal use — you receive and read your email as usual. The attacker receives a silent copy of everything, including every password reset email sent to you afterward.
This means that even after you detect the compromise and change your email password, the attacker continues to receive your email — including the new password reset links they can now trigger for your other accounts. The forwarding rule persists through password changes.
After any suspected account compromise, check all of the following in your email account settings: forwarding rules, filters that delete or label messages automatically (often used to hide sent phishing emails from your sent folder), authorized apps with account access, and delegate or shared access grants.
Forwarding your own work email to a personal account for convenience is a common practice with real security implications. If your work email is confidential, forwarding it to a personal Gmail account means it is now subject to Google's terms of service and security posture, not your employer's.