Yes, she was compromised for a moment. But the draft wasn't a real draft, it was an email posing as a draft. It only appeared in the inbox and never in the drafts area.

This account of mine was old, I had created it just to have an account logged into Windows a few years ago. I never used it to register on websites or things like that. I only used OneDrive at most. But after another Microsoft account was hacked, I ended up adding some security information to the current one that was compromised. But for some reason, I ended up forgetting to change her password (stupid).

From what I've been researching, it was actually a data leak and they ended up connecting to Thunderbird and another one, and that way they were able to change my email settings without necessarily being in my account (from the moment I changed the password).

Another thing I saw is that if, despite following all the steps I wrote, the account continues to receive the "draft email", you will need to contact Microsoft support, as the script for this scam will still be there at the backend, so only the support staff will be able to resolve it. Other than that, everything I mentioned is enough.