It's quite common, in fact my "go-to" hacked account rule in Office 365 is "alert me, system admin, anytime anyone creates an outlook/exchange rule".

Our group is small enough that I get very few alerts at all, and I've caught two compromises that way.