How do I fix this 3 way switch mess?
OK.  A 3-way switch complex acts exactly like a plain switch.  Meaning if you take the two 3-ways and the /3 cable between them, and pretend they're not there, you see what else is going on.  

In this case, if you ignore the 3-ways and /3, all that's left is a /2 cable to the top box.  That makes this a switch loop. 

Normally, in a switch loop, the white wire carries always-hot * and the black wire carries switched-hot.  Code has two things to say about this: 


if a white wire is used as hot, and always-hot is in the cable, then the white must be always-hot*.  Correct that if it's wrong.  
A white wire used for "hot" absolutely must be marked with black tape.  This has been overlooked in these boxes, so you should correct that. 


It appears the last guy wired the 3-way loop with the white wire being always-hot.  That is fine, but again you need to mark the white wires at each of their ends with black tape. 

The remaining wires in the /3 (red and black) are travelers.  I recommend you mark both travelers with yellow tape (readily available as part of 5-packs of colored tape). Travelers don't need to be distinguished from each other. 

Then it's easy: On the 3-way switches, the travelers go on the brass screws, and the remaining wire (whatever it is) goes on the remaining black screw. 







*The white wire is used for always-hot so a voltage tester will always show it as hot; that means it won't be confused for a neutral.  The switched-hot wire will test as "at neutral" when the switch is off, because it's connected to neutral via the light bulb.