Managing personal Outlook.com account settings, security, and privacy
Hello Janey
I'm Diane, an Office Apps & Services MVP specializing in Outlook, and I’m happy to help you today.
SMTP is sending - so apparently they only logged in to send mail, but yes, they have access to your entire mailbox if they have your password.
Enabling 2 step authentication would be better, but changing the password and alias will be enough to keep this hacker out.