It's easy to spoof an email because SMTP
(Simple Mail Transfer Protocol) lacks authentication.
The header of the email message often contains a complete history of the "hops" the message has taken to reach its destination. Information in the headers, such as the "Received:" and "Message-ID" information, in conjunction with your mail delivery logs, should help you to determine how the email reached your system.
If, however, the abuser connected directly to the SMTP port on your system, it may not be possible for you to identify the source of the activity.
http://ask-leo.com/someones_sending_...stop_them.html