We went back and forth with a scammer a few times before we caught on. Nothing was clicked. What happens now?

Short version first: replying is not a breach. If nobody entered an email address and password into a sign in page one of those messages led to, block the sending address, block any unrelated domain that showed up when they replied, report the thread as phishing so your filter learns from it, and delete it. If someone did enter credentials, that is a different question with its own short and specific answer.

The part worth your attention is what replying actually changed. Bulk scam lists are cheap and mostly dead addresses. An address that answers is not. You have moved from a list of guesses onto a much shorter list of confirmed, staffed inboxes, and those get worked harder and passed around.

So expect more, and expect better. The next attempt will often reference the exchange you already had, because picking up a conversation already in progress skips the hardest part of the con. A message that opens with following up on our discussion gets read with far less suspicion than a cold introduction from a stranger.

That makes this a training problem rather than a cleanup problem, and it is worth two minutes at your next staff meeting. Tell whoever else touches that inbox what came through, what it looked like, and that a familiar sounding follow up is likely. People catch the second attempt easily once they know the first one happened, and they miss it entirely when nobody mentioned it.

You do not need to abandon the address. Changing a published sales or info address costs you real leads and buys very little, since the same address gets scraped off your website anyway. Recognition is what handles this one.