Spammers and hackers are always looking for easy password accounts. And the same for usernames. They already have the end part of the email address, eg @yahoo.com , so they can use a generator to generate random usernames and passwords to try logging on.
So the general advice is, change your password as quickly as possible to some strong password.
As to receiving your own emails, it is comparitively easy to spoof an email address.
I don't know how to do it, but spammers do and they will send you an email with the sender displayed as your own email address. That doesn't mean they have hacked into your account, and it also doesn't mean that Yahoo's servers are vulnerable. But it is a common ploy by spammers to do this.
If you can "View Source" for such emails, (we can in email software but I am not sure if it can be done in web mail. Perhaps right click the email in the Inbox and see if there is an option), you will see all sorts of hidden properties of the email, and where it actually came from.
The main question is, how did the spammer get your email address to send you email in the first place, and there are a coule of options for that;
1] Just lucky with a random email address generator tool. For example, if my email address was email@example.com then it would be quite easy for a generator to make that. But if my email address was hTewoJK8wtMkdi3Lli@yahoo.com then it would be much harder.
2] Spammers send millions of emails from their own servers every day to random email addresses. They don't care if 99.999% don't exist and are returned. Those are just discarded. But the 0.001% who get through are noted for future spam.
3] As with 2 above. If the recipient opens the email, then a cleverly crafted email can send a message back to the spammer showing that this particular email address is live and active.
4] Another way to get live email addresses is from public forums like these and public blogs. If a poster adds his/her email address to a post or a blog comment, then forum bots, (software robots), trawl forums and blogs for them and pick them up for spam.