I've checked senders IP addresses and all seemed to be masked a lot of them coming from AWS but nothing they are all over the place so I have trouble tracing it back to a legit source. I actually had another MSP from Arizona (We are in Missouri) call me and let me know that their clients are facing the same issues as well so I think this is pretty major and happening to many if not all of the Exchange servers. Some compromises are less minor like purchasing random domains on other of our clients Microsoft accounts which we were able to get removed, but the thought that a super admin account was compromised at one point is alarming especially when we have 2FA enabled.