Microsoft will add a user to the Restricted Entities list for sending too many messages marked as Spam or Bulk mail. Currently there is not a built in way to alert when a user is listed and it is a possible indication of a compromised account. A case or at least alert should be created when a user account is listed in the Restricted Entities location under Security.microsoft.com > Email & collaboration > Review > Restricted entities.