it is very easy to do.
you take a legit email address and enter it in your sent from and reply to settings in your e-mail software. Send out a bunch of e-mails to a list that was either hacked, purchased, or obtained in any number of ways. On the receiving end, it looks like it comes from the legit addy and any replies go back to the legit addy. However if you open the e-mails full header you will see that the e-mail did not actually originate from the e-mail addy listed.
Its a PITA, but AFAIK, there is not much you can do to stop it.
Has happened to my e-mail a few times, although I have never had my contact list hacked/sent to, just my e-mail addy used to send junk ads to thousands of random addresses.