I think someone else has access to my wireless network. What next?

Solution 1:

WPA (if possible, with CCMP/AES, this may be presented to the end-user as WPA2) is sufficient, provided you have an unguessable password. I recommend using a password generator, or a short unguessable sentence. If all devices support it, disable TKIP.

As to the host systems on your network, check that neither is compromised. In theory, this works by either comparing their state with a known good state, or resetting them to a known good state. Since this is probably not feasible for a home user, monitor their connections (from a different system), and consider setting up privilege restrictions as you already did by changing you Mac's file sharing options.

You should also change the password of your router and all (email, facebook, ...) passwords that were transmitted without encryption.

Solution 2:

In general, I advice you against ever transmitting passwords or any other sensitive data unencrypted in wireless network. The possible attacker does not need to lease IP address to monitor your traffic, so you have no way of knowing if the data was compromised or not.

Because he leased IP address, most likely he just wanted to get access to the Internet. You should always configure any machines on WiFi so that they only reveal the services you could open to public network, because in terms of security, WiFi is public network.

WPA2 can make it reasonably, but not totally secure - if you need total security, draw wires.