A mail account on Zoho has been compromised and used to send an attachment containing malware.

The zoho login and session logs on the compromised accounts show no details. Can you see how the account has been compromised and if the spammer still has access via another route?