Phishing

I had several emails sent from my Yahoo account yesterday. It was just links to sites that must phish for info. I have changed my password but can't see much more info on Yahoo on what else I could do.

How does this work? Has someone woked out my password or is there some other method by which they can use my account? Is there anything else I can do to protect my account?