CompTIA A+ Certification Exam: Core 2 (#19)

Joe, a user, reports that several of his colleagues have received a suspicious email from his account that he did not send. A technician asks one of the colleagues to forward the email for inspection. After ruling out spoofing, the technician verifies the email originated from the corporate email server. Which of the following is the FIRST step the technician should take to correct this issue?

See if Joe’s email address has been blacklisted
Change the password on Joe’s email account
Update the antivirus and perform a full scan on the PC
Isolate Joe’s computer from the network