Months ago I clicked on an email spam link and my email got hijacked. Sent the spam to my whole address book, with all of them showing in my “Sent” folder. I changed my email password and thought I was done. Now a bunch of similar spam has been sent but does NOT show in the “Sent” folder, and I haven’t clicked on a spam link since the first incident. Is this the same hacker from before, doing a follow-up round with the info they got at that time, or do I need to change my password again?
Once they have your mailing list, they can re-use it over and over. Also remember that the “From” field in email is as easily forgeable as the return address on a letter. You can put anything there.
So they may not be using your account to send email, just faking it using the list they earlier copied.
But when in doubt, change your passwords, do multiple malware scans, etc. Security only works if you are paranoid.
If you didn’t do a malware scan, they may have keylogged your password. Or, as mentioned, they could just be spoofing the from line. Run a malware scan, regardless.