My iPhone / apple account might be hacked/ infected, looking for clarification and advice
Tons of mails in a draft state is how things worked before IMAP and mail sync on iOS got better at handling this. Especially with gmail, this was a routine thing - dozens of drafts saved (littered) along the way.

I think you are fine if you know you have a secure password, aren’t seeing actual mails sent and can delete the mails. Extra bonus on the multi factor / alert, but older iOS devices might be grandfathered in as trusted, so perhaps change that in iCloud if you want a little extra resistance from this device without wiping it or signing out.

If you’re paranoid, erase all content and settings on the device, but just the presence of 40 to 100 drafts seems harmless in my experience. Without some other indicator you lost control of the device or the account credentials, I’d just keep it in mind and watch things.