This is what is know as a "joe job".
Internet email generally does not authenticate the From: address.
It is usually possible to send someone an email with a From: address of
[email protected]
Some people have filters on their incoming email that check if the email address given as the From: address actually accepts email.
To get around that spammers send email with other peoples real email addresses as the From: address.
The internet email system was designed in the 1970's when the internet was just used by universitys and the US military. If you had a problem due to some other system you could probably get a real person on the phone who looked after that system.
Joe jobs are a paticular problem for people with their own domains and email set up to receive mail to any address at that domain.
I shifted my domains to a hosting company with advanced email fitlering using dedicated hardware from an antispam company a few months ago because this kind of thing was getting rediculous.