phishing attacks and exploits

If someone manages to compromise your user credentials/account via a phishing email (office365 email account in this case) what is there typical objective(s) in doing so, and how would they typically follow that through to the next stage. I would have assumed if there target would be to steal emails they would not just casually start forwarding them on to an external address?  Trying to determine what they may or may not do if they do get a victims credentials would be interesting. there must be something in it for them but to determine what that is and how they execute 'phase 2' once access is achieved would be most useful,