Identify the detail behind the alert
Check the source, date and whether the record includes more than an email address. A finding may be old or incomplete, and the wording of an alert should not stand in for evidence.
Review the relevant account
Open the account provider directly. Follow its recovery instructions if you see unauthorized activity and review available security settings. Avoid replying to an unexpected warning with sign-in codes or passwords.
Keep a record of the response
Note what you changed and what remains uncertain. If the alert concerns another service using the same email, review that service separately rather than assuming the email account itself was accessed.