First of all, I would change my password.
Secondly, if at all possible, turn on two-factor authentication of some kind, so that you will be able to reset your password if someone should get access again, and actually change your password (is this possible with Hotmail? I know GMail supports it). You definitely don't want to be locked out of your own account!.
Thirdly, I'd try to scan the accessed accounts for any important personal information that someone could have read. If there are emails that contain information about other accounts for instance, you will definitely want to change the passwords to those too. You should also check if any emails have been sent from your account, or if there is anything suspicious in the deleted folder, just in case (although it would be a little surprising if whoever accessed your account had done anything like that and not cleaned up after himself...).
Also, if you are using the same passwords for several different services, be sure to change all of them.
Finally just a quick spur-of the moment idea:
Admittedly, this is not very likely to succeed, but uf you really want to try to catch this guy, you could attempt a sort of reverse phishing attack against your own account: Send an email to yourself with a title like "Todo", and a link to some site you control. Read the mail so it will not appear as new / unread, but leave it at the top of your in-box. With any luck the person reading your mail will click the link out of curiosity.
If you set up a page at that URL which gathers as much info as possible about the user, perhaps you could get some useful info(1)? (IP address, OS, Browser, possibly cookies, other things?). You could also make the site request location data. Silly additional idea: Perhaps make the page play a loud sound clip, just on the off chance that your account had been accessed from a computer in a public space at your college, where you or someone else might overhear it and catch the person red handed?
(1) I'm assuming of course, that you don't want to actually try to break into the attackers machine, or trick him into giving you his own e-mail and password, or do anything else that might be ethically questionable, although that should obviously be possible too.