Have you received an Email from a friend or contact that looks like this?
"Unable to show full message.
You can view it by clicking here"
Notice that there is nothing personal in the note and it is not signed. When you click the "here" it will ask you to sign on with your Email User ID and Password. That is not a real sign on. What you have done is give both your user ID and your password to the hacker, who can now sign in to your Email and send that same message to all your contacts.
If you accidentally fall for this - Change your password immediately.