Assuming that your site has not been compromised, and that there are not unknown admin-level user accounts, then this could just be a case of mail spoofing. (Where a person places your email address as the ‘from’, but the email is really being sent by an external process.)
I’d change all credentials (hosting, FTP, admin-level users). Then look for unauthorized admin-level users. I might also create a new admin-level user with a strong password, log in as that user, then change the old admin user to a lower level (subscriber, for instance).
I might also look for evidence of site compromise. Update everything (WP via the Admin, Update screen, themes/plugins manually via FTP). Then look at all folders for files that shouldn’t be there (they will have different timestamps because you updated everything). Also check the htaccess file.
And check generated pages page source for unusual code. I created a process to de-hack a site here, perhaps that would be useful to you. (There are many googles/bings/ducks about that subject also.)