Yes. The finder / thief can use your phone unless you protected it with a passcode lock.
If you cannot use the iCloud find my iPhone app to remotely lock the device, your data is at risk.
If you chose a passcode, hopefully the finder can't guess it. Apple does limit the wrong guesses, so the casual thief can't brute force it.
If you can't secure the device remotely, start on changing all the passwords and monitoring all the services and apps you stored credentials on the phone.
- social media
- work apps and files
- things like contact lists and social security numbers
Going forward, get an app like 1Password so you can easily change all your compromised passwords and limit the damage that losing control of your email entails.
See: Wiping a stolen iPhone that wasn't connected to iCloud and Stolen iPhone: what is the security risk? for more tips.