Once someone has access to your computer then can get absolutely everything you have access to. If this was not possible, then you would not be able to do those things either.
The way to avoid this is to not give someone access to your computer or your logged in session on the computer. Log out and have them log into another user.
Not very well.
In theory, the system should work. In practice, it doesn't. The implementations intended to manage revocation - namely CRL and OCSP - both have problems. Most of this answer is based on this article by Alexey Samoshkin, as well as this article by Scott Helme.
What about CRLs?
A certificate revocation list is a remarkably simple way of ...
The short answer is no.
That error means that there is a problem on Openmailbox's end of things and changing how you connect to it will not resolve the problem on their server. You should contact their support, and let them know their SSL is not validating properly, then wait until they fix it before trying to connect to your inbox again.