Question: what can someone do if they have your apple id?
Answer: The only thing someone can do with your email address is send you an email. If they don't know your Apple ID password, they cannot access your account at all. Even if someone did have your password, all they could do is log into your Apple ID account on the iCloud.com website or sign into it on another iOS device.