1. How your account could have been compromised
You need to consider how your account became compromised. Frequently this happens when someone responds to a phishing email, have you recently received an email which directed you to a page where you entered you account details? Tips for recognising phishing emails can be found at:
Even if you are confident you have not responded to any phishing emails there are other ways a malicious person may have discovered your credentials. Consider the devices you have used to access your account, this includes personal and University computers, portable devices such as phones, tablets and laptops, and any publicly accessible computers in places like Internet cafes and libraries. Are you sure the software running on the devices you have used is up to date? Where appropriate, is anti-virus software installed and is it kept up to date?