[BrianG]

It may not be a hack at all.

If you have access to a PC with IIS installed (easy to do) and add the SMTP add-in, it's very easy to spoof emails. I sort do that all the time at work to send automated emails and such from my applications; I specify the "to" address, the "From" address, the subject, the body, and off it goes even if there is no legitimate mailbox for the "from" address I used. Even though it looks fine in your inbox, if you look at the mail headers closely, you will see that it isn't legit. I obviously use this "feature" for good, but spammers don't.

BTW, that's one way spam filters can verify that one email is legit while another is fake even though they appear to come from the same address.

If your emails were truly hacked, you should definitely change your password to something less easily hackable. Although with today's tech, even super strong passwords can be broken in short order if they want in bad enough...