Report them directly to Hotmail, as a new "My friend’s been hacked!" option under the Junk menu.
On click, MSN returns you this message:
Give Hotmail notice that the email account may have been compromised so they can follow the spammer's behavior and determine if they need to stop the account from being abused.
On the other hand, if it is your account being compromised:
- Change your password,
- Change the secret question and answer,
- Change the alternative email address.
If you think that personal information from your Hotmail account has been used to commit ID theft, you can contact the following authorities:
- Your credit card company
- The FTC: National Resource for Identity Theft (In the United States).
- The Anti-Phishing Working Group at spam@uce.gov.