My main account was hacked - I have been saying I suspected that the fault was either a combination of a mass hack/ddos or that the chaos was used to brute-force passwords and such. Sadly VM refuses to allow IP Access logs so it's impossible for the end-user to know (None of their staff will Deny what I suspect). I had three accounts attempted I think, one was lost, one they failed (not sure why), the other I was able to change back. Since then I have also been receiving quite a bit of spam. Don't expect anyone in VM towers to help you with this. Change the App Password, then change your main web login password.
The big bugbear in the room is that compromised accounts that don't reset their APP Password will remain compromised - because people expect the password to be the password and not for some second secret password to come out of the blue. VM has really done a bad thing here and no one seems to care.
Side note - My "Password" has not appeared on any compromised list through the dark web yet, so it's possible - but not likely - that emails were being read in some other way. I had a similar problem probably 15 years ago and strangely they were trying to reset one of the same accounts - at that time VM did check the IP logs and it showed no one else using my account.
VM bod on phone said I probably clicked a link (guessing he was meaning I installed malware), but 14 email addresses and only one was compromised.
So change your App password (to log out all external Email Applications) and then change your main web password (So they can't log in and change it again, or view webmail). It's worth looking in webmail to see if they have any forwarding filters set but I doubt that will be the case (too much work, not easy to automate).