bellsouth email account hacked

Hackers have substituted an alternative email address to which my bellsouth emails are sent instead of to my account.

So is it a send problem or a receive problem?  If it's a receive problem how would you know they changed anything unless you looked at your settings (see below).  And if it was a send problem in that you don't get any replies you would see that in the From: field when you do a compose or the forwarding setting.

Here's my standard list of things to do if you suspect someone actually got into your webmail account.

• Change your password and security questions. The link I supplied allows you to change the password three ways; using your security questions, using your recovery email address, or by snail mail.
• Log into your webmail through start.att.net and click the settings gear->more settings. In there you will see a number of commands on the left. The ones that need checking are Mailboxes, Filters, and Security and Privacy.
• Mailboxes. Click that and choose an account in the Mailbox list to bring up that account's settings panel on the right. Check the name and reply-to address and see if it is suspicious. Blank it out if you don't want that set. Check the forwarding setting and make sure it is blank or what you want. Check the other settings there as well. When you are done click the Save button at the bottom to update that account's settings.
• Filters. Look for suspicious filters and subtle filter names like '.' (a dot) or ':'. Remove them and click the Save button.
• Security and privacy. Make sure no addresses are defined who's email you don't want blocked. Click Save to update those settings.
• Contacts list.  While it doesn't affect the running of the webmail it's still good to check to see if everything you expect is there.  If you contacts are gone you may be able to restore them clicking on the Contacts Actions in the toolbar and selecting "Restore from backup...".

In the accounts mailbox settings look at the name, reply-to, and forwarding settings.  The name and reply-to are what appears in the From when you compose an email.  That's what the recipient will see.  If they reply that's where their email will be sent.   The Forwarding would redirect email you receive to that address.  But still you should see received email in your inbox (or spam).