All they need to do is type their made-up address @ your domain name into the sent by/reply to fields of their mailer and most email applications will treat that as the originating address. This is actually useful - it lets me "send" from my two dialup accounts via my wires-only broadband account - but it leaves the door wide open for non-entities like this. If it's just bad luck that they picked you then changing domains will fix it, but if it was done with malicious intent then setting up your new domain as the source will take just seconds.