Pretty much "they" can't; your account is accessible only with your password. Odds are the message you thought was from Yahoo! was a
Phishing scheme, aimed at identity theft. If the message presented a link urging you to to "click now" or "click here" or some variation thereof, in order to "log into and verify your account", thats certainly what it was. Yahoo! had nothing to do with it - it originated from a scammer/spammer, who simply spoofed the Yahoo! stuff to get you to do what the spammer'/scammer wanted you to do. I hope you did nothing, other than perhaps deleted the message.