do you really need malware to forward copies of emails elsewhere ?
No, but that is the common implication. That is why I add the modifier “re-direction”, thru-out.