At 3:20 this afternoon, my Hotmail account sent a bunch of e-mails to everyone in my address book. The e-mails appear to have been links to who-knows-what-sites.
I've changed the password on that e-mail account. At the time the e-mails were sent, I wasn't logged in on any computer, nor was my phone on the internet, so I don't know for what to be on the look-out?
Changing your password is about all you can do, but I'd also suggest checking and updating your lost password retrieval information - the secret questions, alternate addresses, phone numbers, that sort of thing. I don't recall exactly how Hotmail does all of that, but it's a good time to change those answers to those secret questions (or use different questions), and make sure the alternate address is still one you have access to.
You have to assume that whoever got to your contact list also got thru your account information as well. Anything that can be used to get a password and log back in needs to be checked so they can't use it to go in again.
I'll take my turn being the obnoxious ass who mentions that, once you get put back together, I assume you'll want to get a backup strategy in place. I haven't had to retrieve anything back out yet, but Time Machine seems reeeeeeeally slick, smart, & easy.