Your email address has been "Spoofed".
They do NOT even need to have access to your email server, all they have to do is set up that your email address is the return address.
Have a read at http://en.wikipedia.org/wiki/Email_spoofing
They do NOT even need to have access to your email server, all they have to do is set up that your email address is the return address.
Have a read at http://en.wikipedia.org/wiki/Email_spoofing