It can be both a technical and legal problem. Secure the account and associated email immediately, preserve evidence of the compromise, and consider reporting the incident where criminal conduct or misuse of personal data is involved.

Change passwords, activate available security controls and warn contacts not to rely on suspicious messages. Keep screenshots and relevant transaction or login information before it disappears.