My opinion on this:
1) Change your passwords (all of them) right away, and do it from a different computer just in case there is malware hiding on your machine that you have not found yet.
2) Don't use yahoo for business email, unless you don't care about professional appearance.
3) If the problem continues, get a new email address. Don't just change the account name, get a completely new email account, ideally with a provider that will let you register your own domain name - something related to the business - and use that instead of the old one. Let your legitimate clients know about the new address and tell them to delete/ignore anything they receive from the old address. Keep checking the old account so you don't miss anything from your clients, but don't automatically forward email from the old account to the new one as that will just let the spammer/hacker/etc know where you went so they can keep sending garbage to you and your clients.
4) Don't ever use your main/business email address to sign up for online services, mailing lists, message boards, etc. as spammers often use those to gather addresses for their spam lists. Get a free/junk account for that and do not associate it with your regular address/contacts in any way.
Even if you ignore the rest, do #1 immediately (and more often than once every 7 years in the future).