Email has been highjacked

Here's the things that I recommend you do and/or check for a hacked account:

• Change your password (and maybe the security questions too, but password is usually "good enough").  The link I supplied allows you to change the password thee ways; using your security questions, using your recovery email address, or by snail mail.
• Log into your webmail through start.att.net and click gear->settings.  In the webmail settings panel you will see a number of commands on the left.  The ones that need checking are Accounts, Filters, and Blocked Addresses.
• Accounts.  Click that and choose an account to bring up that account's settings panel.  Scroll down the panel to see the name and Reply-to address and see if they are suspicious.  Blank it out if you don't want that set.  Scroll down further to see the forwarding setting and make sure it is blank or what you want.  When you are done click the Save button to update that account's settings.
• Filters.  Look for suspicious filters and subtle filter names like '.' (a dot).  Remove them and click the Save button.
• Blocked Addresses.  Make sure no addresses are defined who's email you don't want blocked.  Click Save to update those settings.

As for your contacts receiving email you did not send a spammer doesn't need to log into your account to do that.  So if they have your contacts list they simply spoof the sender to look like it came from you (or whoever).  For example, the way you would spoof from your yahoo email account is to specify the name and reply-to fields in an accounts settings to some other name and email address.  It doesn't even have to be valid.  This is why I also suggested those fields be checked above (Accounts).

If they are now just spoofing/spamming without logging into your account (check the send emails mailbox) there's no way to stop it.  If the spam has some unique string common to all of them (other than your name and email in their From field if it's always "you") they will have to set up an appropriate filter (rule) if possible to trap those as spam and handle accordingly.