Review active devices and revoke access you do not recognize.
This signs out all sessions and prevents normal sign-in until the account is administratively restored.