Someone has definitely gained access to two of my alternate emails. I know this by looking at the login activity. By looking at the email logs I discovered that the IP that is always gaining entry to my email is not my own.
I haven't changed my passwords yet because I'd like to somehow figure out who is doing this. What should/could I do about this?
TL;DR:
You should change your passwords ASAP. From a machine that you trust.
What good is it going to do that the attacker can still log in too? What if they find a way to change the password, too?
Any suspicious activity should already be logged, so go to your sysadmin and/or Hotmail, and let them do the detective work.
As was pointed out in the comments, you will be held responsible by Hotmail for activity on your account. So don't let someone else impersonate you.
Don't jump to conclusions about who the attacker is. It may just as well be someone from outside your campus, who managed to gain remote access on some of the computers there, and installed a keylogger.
The possibility of a keylogger is why you should change your password from a machine that you trust. You may want to run your AV software on that machine before changing passwords.
As was pointed out in other answers - enable two-factor authentication while you're at it, if you haven't already. This will make it difficult for an attacker to change your password in the future.
Also, you should contact the authorities in question - notably the local sysadmin. Unless you have a good reason to suspect the sysadmin, they are the one to go to - security on the local network is their responsibility. If something fishy is going on on the network, they should be warned ASAP. They'll want and need to know.
First of all, I would change my password.
Secondly, if at all possible, turn on two-factor authentication of some kind, so that you will be able to reset your password if someone should get access again, and actually change your password (is this possible with Hotmail? I know GMail supports it). You definitely don't want to be locked out of your own account!.
Thirdly, I'd try to scan the accessed accounts for any important personal information that someone could have read. If there are emails that contain information about other accounts for instance, you will definitely want to change the passwords to those too. You should also check if any emails have been sent from your account, or if there is anything suspicious in the deleted folder, just in case (although it would be a little surprising if whoever accessed your account had done anything like that and not cleaned up after himself...).
Also, if you are using the same passwords for several different services, be sure to change all of them.
Finally just a quick spur-of the moment idea:
Admittedly, this is not very likely to succeed, but uf you really want to try to catch this guy, you could attempt a sort of reverse phishing attack against your own account: Send an email to yourself with a title like "Todo", and a link to some site you control. Read the mail so it will not appear as new / unread, but leave it at the top of your in-box. With any luck the person reading your mail will click the link out of curiosity.
If you set up a page at that URL which gathers as much info as possible about the user, perhaps you could get some useful info(1)? (IP address, OS, Browser, possibly cookies, other things?). You could also make the site request location data. Silly additional idea: Perhaps make the page play a loud sound clip, just on the off chance that your account had been accessed from a computer in a public space at your college, where you or someone else might overhear it and catch the person red handed?
(1) I'm assuming of course, that you don't want to actually try to break into the attackers machine, or trick him into giving you his own e-mail and password, or do anything else that might be ethically questionable, although that should obviously be possible too.
It might not be an admin, networksec, or a teacher. What if someone hacked their login? It might be best to raise the issue with your school. Do they have anyone that manages the security of their systems? Perhaps ask for a meeting with them and your college principal to have the issue investigated.
