You have my sympathies. One weekend someone used my address in a similar fashion and proceeded to tell the world and his wife about the virtues of a particular credit card. If its any consolation I feel that most folks are savvy enough to know that spam header info is almost always fake.

Forging the return address can be as simple as changing your return email address in Outlook. More serious is if they have hacked into your site via a poorly written form mail CGI script or similar. If this were the case your ISP will almost certainly have spotted it and blocked it.