How can I find and remove a former developer’s email from our website forms?

If you have the source code, search for the full address and distinctive parts of it. Also check environment variables, configuration files, server-side mail handlers, CMS plugins, hosting settings, and any external form provider. A simple search-and-replace may work, but it’s safer to move the recipient into a secured configuration variable so it isn’t hardcoded again.

Treat this as a possible security and privacy incident, especially if the forms contained names, contact details, payment information, health information, or other sensitive data. Preserve relevant logs and records, remove the unauthorized recipient, rotate hosting, SMTP, API, and administrator credentials, and have a privacy or legal professional assess whether notification or other reporting is required. Don’t assume the issue is limited to the website code; email and hosting infrastructure can also contain forwarding rules.

First determine how the site was built and where the form submissions are processed. If it uses a hosted form service or CMS, you may not find the address in the website files at all—you’ll need to inspect that service’s account and notification rules. Make sure your company controls the hosting, domain, mail, source repository, and third-party accounts before making changes.