This has happened to my business about once a year for the last several years.

I agree with Ron's assessment of what's going on. ONLY your email address is being used - no hack to your website, your address book, or your email account.

You're only seeing the return bounces, exactly as Ron said.

I disagree with Ron, in that there is usually an agenda with these things. Perhaps the secret lies in the 'attachment'. Have you looked at it? It could be something as innocuous as an advertisement for boner pills, or flat belly pills or some such silliness.

It could also be an executable file intended to do harm, slurp data, install malware - a true virus. Although most every responsible computer owner has antivirus protection that will stop it, every now and again one will get through - making it worth their while.

The good news is that will stop, in my experience, almost as quickly as it started. You should be all done with it in a couple of days.

My IT guy wants me to remove all email addresses from our website to stop this kind of 'harvesting'. So far, to his chagrin, I've resisted.

Hang in there. This too shall pass.