[citation][nom]bogcotton[/nom]I don't know much (anything) about the mechanics of online email services, but if the scammers used a machine to log on to all of the accounts simultaneously and not log out, would the user changing the password make any difference to the already logged in browser?[/citation]
It depends on the provider, and whether the user had selected "keep me logged in" in their preferences. Still, several of the providers would catch the logins and activity coming from two places (the real user, and then the bot) and they might flag that and reset the session. That would probably put the new password into affect, blocking the bot. Also, last I checked, Yahoo's online webmail had a maximum of two weeks it would "remember" you before you had to log in again, at which point the session would reset. Even then, usually the remember feature comes from a cookie on the user's computer that the bot would not have access to (in a simple phishing scheme).
So to answer your question: If the changed password did not immediately block the bot, it would before too long. The bigger question though is still whether this was a phishing attack and the user was tricked into giving ONE password, or a key-logging attack that will CONTINUE to report on the new passwords.