Check your accounts' signed-in devices and authorized apps every so often, and remove the ones you don't use

Moderate value
Evidence C
Saves money
Free
Takes minutes
Some willpower

In plain words

"Signed-in devices" are the phones and computers that can still use your account right now. If the list shows a device you don't recognize, or software you stopped using long ago is still connected to your account, change the password first, then sign out of all devices. In your email, also check for any automatic forwarding you didn't set up.

Cost: Free. A few minutes each time. The hard part is that nobody reminds you, so you have to remember to look.
What you get: An account's list of signed-in devices records the phones and computers that can still use the account. The list of authorized apps records other companies' software you have allowed to sign in with this account. Unfamiliar devices in the list, and third-party software you stopped using long ago, are the traces easiest to spot. The UK's National Cyber Security Centre lists "logins and login attempts from unfamiliar places or at unusual times" among the signs to check for a hacked account. It also says criminals often set a forwarding rule in your email so that every message sent to you is automatically copied to them, and they can use that to reset your password. The order it gives is: first find and remove forwarding rules you don't recognize, then change the password, then sign all devices and apps out of the account. After you sign out, anyone who wants to use your account again has to enter the new password. The U.S. Federal Trade Commission also advises that once you get the account back, you sign out of all devices and delete forwarding rules you didn't set.
Notes: WeChat, Alipay, email, Apple accounts and Android accounts all have this screen. If you find a device you don't recognize, change the password first and then tap sign out of all devices; that is the order the UK's National Cyber Security Centre gives. This is rated C because both sources are official how-to guides, and no study has worked out how much loss regular checking prevents.
Evidence grade: C : The author's experience or common practice, without direct literature.
Sources: UK NCSC. Recovering a hacked account. https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account
US FTC. How To Recover Your Hacked Email or Social Media Account. https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account
两份都是账号出事以后的处理指南，「隔一段时间主动去看」是作者经验

Translated from the Chinese original. Original book, section 14, tip 6. Content may be out of date and rules differ by place. When you actually deal with an agency, a doctor or a court, follow what local officials, doctors and lawyers tell you. Disclaimer