A compromised email account can be used to reset other passwords and contact your friends. Take action in the right order.
1. Regain control
Change the password from the official website, sign out unknown sessions and enable two-factor authentication.
2. Check settings
Review forwarding rules, recovery details and connected devices. Remove anything you did not set up.
3. Warn contacts
Tell contacts that fraudulent messages may have been sent from your address.