BTYahoo email accounts being hacked

This is still going on, in my case with yahoo uk, not BT yahoo accounts. I only collected them today, but the mails were sent at the begining of June. The interesting thing is the two accounts I've got spam from were my own very, very old yahoo accounts that literally haven't been touched since the day they were opened. A couple of friends and family members have had the well advertised problem previously, but all cases were email accounts in use, and the problems could have been down to a compromised system. In my current case the accounts were originally created to purchase some dirt cheap short-use domains from yahoo, then ignored - the only reason I imagine they are even still in existence is the yahoo business connection.

- both accounts had only one email addy each in the address book (both on different domains), which was also the 'secondary' email for the account; these were the addresses the spam arrived at

- the email addresses used as secondary on the yahoo accounts are throwaway aliases which have never been used for anything else, so prior to the spam/phishing email they'd never sent anything outgoing, and had only ever recieved one email each, seven years ago.

- neither account has been used by me in 7 years, and were only ever used to receive mail on one occasion.

- neither has ever been set up on an email client; access was only ever by webmail, and then on an old machine now unused and under the bed for at least 5 years

- both had random 16 character passwords using all character types and only ever written on a piece of paper (which I miraculously, unbelievably found today!)

- the header all appear to be legit yahoo headers sent via webmail, originating in Bermuda - much the same formats as the ones I got a few months ago from friends/colleagues accounts.

- neither account was altered in the sense that passwords or secondary emails were changed (old PW still got me access) or 'security questions', although the sent emails were not in the outbox - presumably deleted.

My point with all this is that short of a brute-force attack (surely unlikely to succeed on a webmail portal against a reasonable password) this suggests yahoo have some very serious vulnerability that does NOT rely on XSS, keylogger or some other means of harvesting PW, secure cookies or whatever from client PC or phone browser or a mobile app - PW is ONLY on paper and a Mac unused for 5 years.

The scale on which this was done previously made me think the statements from BT yahoo as to 'how' were bullshit; I'm absolutely sure of it now. I have a couple of 'junk only' yahoo accounts I do still use for forum signups etc, but I think its time to dump those too.