The natural assumption is that the hacker has got your password, not hacked gmail or hotmail, etc.