My e-mail hacked by a MacOSX Member

[Doctor X]

I have cattleprods. . . .

--J.D.

[Giaguara]

And change your security questions too. If they are easy to guess, such as mother's maiden name or any of the default question/answer combinations, get rid of them.
Have a question that only you know the answer - and this can mean the answer has absolutely no relevance to the question. Such as "what is my brother's shoe size?" > "I hate ice cream cars!" etc. Only you should know the logic the password recovery question uses. Same can go with recovery birthdays. If they only need to know your birthday to prove they are you for a forgotten password, that's just not enough (unless your birthday is totally made up).

.mac can see a track from where and how an account was accessed. Verify with them that they haven't been contacted as a 'forgotten password' problem by this gmail+whatever ad bricbrac this person is using.
They should be able to tell more about when and from where such forward was put in place.

And never store the pws in keychain if you don't lock your computer when not at desk (as in someone at home or office walks to your desk, and gets logged in...)
I've seen people leave their passwords on a piece of paper at their desk, including someone I worked with had her SAP password on a sticky note (where with her admin account you could do nearly anything at all).