As the other posters have said - go straight to the police.
I had something similar happen a few years ago. I had checked my email at my friend's house, and her ex husband (separated for years - I had never even met him!) had a keystroke logger on her PC.
From that point on, he started going through my emails (to the point that he was deleting spam, moving stuff into the relevant folders, basically treating it as if it were his own account), changing info, posing as me on Facebook, sending out/accepting friend requests.
That was the scary bit for me - I don't use Facebook and he just hi-jacked my inactive account, so when I found out about this and checked I found that he had put all my personal info on 'my' FB account - address, phone number, email, date of birth. It felt menacing, as if he was trying to let me know how much info he had on me.
I went straight to the police. They were very helpful. Unfortunately, due to FB's complete unwillingness to help them investigate by handing over details of when my account had been accessed, and from which IP address, they couldn't prove it was my friend's ex. FB gave some pathetic reason about me not complying with the site's terms and conditions properly as I hadn't given my full details when I opened the account - basically, they didn't want to help, and the police said that they weren't suprised.
Having the police involved scared him off though, so in that respect it was a success. You may be surprised by how much the police can help and advise.