I was hacked 3 different times within about a year, and I really don't know how the hacking was accomplished on any of those occasions --- at first I didn't even know it had happened, until some people started complaining that they were receiving strange emails or commercial-advertisement emails from me. Then, shortly afterwards, I started receiving similar kinds of emails from people in my contact list. I don't know if it was my infected email that infected them, or if they were being hacked independently from me.
I had 2 email accounts at that time, Yahoo and Hotmail, and all three hijackings were on the Hotmail account. The 'bad' emails kept being intermittently sent from my email address, in spite of the fact that I changed my password and personal information, until I finally read some advice (from one of our members on the Vista Forum) to delete my contact list. I also learned NEVER to open any attachment unless I was 100% sure that it was safe. Both actions seemed to help, because in taking those two precautions, there was no longer any vehicle for the hijacking -- to either receive the infected material or to send it out.