Two quick notes. One, it doesn't mean that someone clearly broke into your account. I used to send mails to a friend from [email protected] using telnet for giggles (yes, he knew about it, I was demonstrating spoofing to him). If I send email to a server with crap verification using your email address as a reply-to, it may very well bounce to your actual account. There's nothing you can do about it.
Second, there are countless people who end up getting into a situation like this. A spammer probably set your address as the bounce or reply address. You can't stop it, and it usually declines or goes away after awhile. The best thing I've found to do that leads to minimal hassle (or at least minimal hairloss) is to create a filter on my mail client that will delete the messages, moving them to another folder and/or erasing them at logout. Other times you can train a spam filter to catch these messages and hide them for you but it may lead to missing actual bounce messages.
Look in the headers for a common line (or if you're lucky it has a common message body) and create a filter rule or train a spam filter system to treat them as junk.
Worst case scenario? A person (forgot her name) has a writeup on the Internet where she (think it was a she) described how her email address was used by one of the famous Internet malware worms as a return address, and it flooded her email as people were foolish enough to reply to it, along with bounces. I think she ended up changing her email address to ditching the old box as bounces grew to the thousands a day.
Usually it never gets to that point, though. First try filtering method.
EDIT: I'll also add that even if you did track down the source, chances are slim anything would be done about it. If it's a botnet, you can't find one source, it's coming from some idgit' that probably doesn't know or care that their computer is zombied. If it is from some idiot who thinks spam is legitimate marketing, they sure as @#% aren't going to listen to your complaints (you're "collateral damage.") If it's a foreign ISP, well, again...they don't care. The only one who might care is AOL, and if you forwarded the information to them and they shrugged their shoulders, you already know they don't care. They might even have been turned off the moment you said your account was "hacked"). ISP's typically know if someone is sending spam. They can make some money off it and are already shady because they know it leads to blackhole lists and counter-spammers bugging them. AOL probably paid just enough attention to your report to verify it wasn't originating from within their network and then shrugged you off...
