I was just going to say the same thing that the first response said. Your account itself doesn't need to be hacked in order to spoof that emails "came" from your address. And once they have your "contact list" there is nothing that you can do about it since it is just a list of other email addresses. I mean, once someone has your phone number they can call you. If they get a list of your friends' phone numbers, they can call those phone numbers. Nothing you can do about that unless all your friends change their email addresses.
But if they do have your contact lists, I suspect that you have a keylogger or other software installed on your computer. Scan it with anti-virus and anti-spyware software such as Malwarebytes, Spybot Search and Destroy, and/or Hijack-This! or similar tools.