That was the point of the whole thread wasn't it, to stop this from happening? Your passwords were compromised if the account was sending spam even when you personally had not logged in...that means "somebody" was using the account because the password had been figured out.
Really the choice is yours and yours alone. You can do what you want to do, I was just giving the information it is up to you to decide what to do.