I've literally just served a customer with this who has had the exact same problem.
I don't for one moment believe someone has hacked into your account and sent emails out to all your address book - there is no logic behind doing that.
It is web based so I can't see how it could happen from your system being infected with a virus and/or spyware.
I'm really at a bit of a loss on that one - I've suggested the customer contacts MS, as I can only assume their servers have been infected with a virus of some sort or something along those lines.
I would suggest you export your contact list to a file on your desktop, setup a gmail account and use that instead - that is what I've done for said customer.