Till, thanks again for your response and help.
Two months ago, I installed a StartSSL class2 certificate. Following that I set up 2 sites in Joomla. Before that I know mail was working because I did a site for a guy and tested that his mail was working.
When I got a complaint about mail not working, first I checked root mail, which I should check more frequently. That's when I noticed that my daily MySQL backups had stopped working. Reason: the backup directory was missing. That's why I thought I was hacked.
I don't remember any notice from my ISP about changes. Perhaps the next step is to contact them and ask what's going on.