Why do I get a bounce message from an email I never sent?

1. A spammer may have used your email address for his spam, and you got the bounce. Mail servers are getting smarter about insisting that email come from real domains. This helps eliminate the getsome@sexypictures.now type of return address that's never intended to be used except to satisfy the requirement that mail has to come from someone. In the past, mail servers just checked for a return address, so spammers could (and did) put whatever they wanted there. Now that servers are checking for valid return addresses, spammers aren't using their own -- they're using yours. This lets them send all the spam they want while you get the complaints and bounces. There is absolutely nothing you can do about this. Until all servers start requiring authentication (and even then, unless other servers only accept mail that's been authenticated) the problem will continue. Fortunately, this minor form of identify theft doesn't damage your reputation. The headers clearly indicate that the email didn't originate with you. Some individuals may read the headers and think the mail came from you (or just reply with a nasty note without bothering to look at the headers), but spam fighting organizations and most mail administrators won't be fooled.
2. Someone to whom you've sent mail in the past, or who has your email address in her address book for any other reason, may have a virus/worm/trojan (like Klez) that sends out mail with forged headers drawn randomly from the address book.
3. Some spammers send fake bounce messages to trick you into opening the email.
4. Some virus/worm/trojans send fake bounce messages, too. You click on the attachment to see what message bounced, and viola! you are now infected.
5. You may have a worm that's sending mail from your computer without your knowledge or consent. You typically pick up these programs by running an executable attachment, or by browsing to an unsafe site with all the active-content doodads enabled. You should:
   1. Turn off all scripting support (VBScript, JavaScript, JScript, Java, etc.)
   2. Use a more secure web browser, something other than IE.
   3. Get a virus checker.
   4. Update your virus checker definitions regularly.
   5. Get and run one or more anti-spyware applications.