i have changed my password since the compromise and used the authenticator application.

i believe the hack occurred when using hotmail on a public wifi from my phone. annoying as i'd assumed that ssl over the public wifi transport would _not_ allow spoofing of cookies.