How someone would routinely email out a Google Doc

I have seen an issue where an account has been compromised and someone is routinely emailing out the contents of a google doc to another gmail account. The account password has been changed and the filters have been checked but the emails persist.

How can an attacker be scripting this and how can the script be interrupted?