Software :: Log File In Console - See Loaded Programs?

It appears as if my wife's Mac was hacked last weekend. I am not a nubie to computers but am not so familiar with security fr a Mac. I am trying to see if the Whole Foods website is the cause of this hack. Below explains what happened. On Sat 7/17/10, at about 11:30am we began getting telephone calls that my wife's TWO separate email accounts (one Yahoo and one Hotmail) had sent out an email that we had made a "surprise" visit to London and had been attacked and robbed etc and the email asked for money. A second email was sent a half an hour later asking for money to be wired to a Western Union reference number. Upon checking my wife's Yahoo account from a different computer than my wife's Macbook, I found the account password had been changed. After notifying Yhaoo that her account had been compromised, I learned that her Hotmail account had also been sending emails as well. The passwords are different for each of the accounts. Rebooting the machine after finding out of these emails took an unusually long time. Clearly something was amiss. As we later found out, the Yahoo account, my wife's primary account, had been setup to forward all her mail to forward.forward@hotmail.com the "bad guy's" drop account to collect her email. Her Hotmail account had not been setup to do this though. The culprit must have been her Mac Mail program on her Macbook-- only this has the capability to retrieve both accounts. No other computer has this capability. The passwords for both accounts were saved on the Macbook. My wife had no security in place-- admin p'word was blank, no firewall etc. This has been changed. What log file in the Console can I look at to see what went on during the time that I think a compromise took place? I have since loaded IAntivirus (free)on her machine.

How can I ensure that nothing has been loaded onto her machine that will give someone a backdoor into our network or her machine. Could a keystroke logger have been loaded as well, maybe a backdoor port? How can I see what programs have been loaded? My wife uses the latest version of Firefox at all times. The newest version downloaded this week, so she was using the prior, most up to date version at the time I think an attack occurred. Ditto for the OS. I have thought about a localized attack-- one that occurs when someone is within physical proximity of the laptop, but we live in a suburb and she rarely takes the laptop out of the house.