Normally by the inherent nature of how email works it is possible to spoof email ids. But as you are seeing Undelivered reports, seems something fishy.

Your email might have been hacked.

1)Change your password
2)Change your security questions
3)Change the backup email address that you might have given in case if you forget the password

If you system is infected, then doing all the above is just waste of time. Do the above steps on a clean system. Then format the infected system. This is better than scanning the system for malware as you will be never sure whether all the threats has been neutralized.

The answer to question 1) is they could. However once they have the email account they'll want to draw a little attention to it has possible. Making those changes would be the opposite.

Check to see if you're account is being accessed from anywhere else. That's one of the features I like about Gmail, it'll show me what other ip address have accessed the account.

2) not logging in for a while makes the account a prime target. Because you don't know what's been done AV and AM programs are reactive, so you could be infected for a few days and not know it. Some of the nasties hide by disabling updates and others. You'll think it's working right when it's not.

Check your out box. see what's there. Also read the whole header of the emails.

Lastly 1 account 1 password is best. I've had several friends recently (over the last year) sending spam. Not spoofed, from their accounts, that they didn't send. Mainly  because the thought the were logging into a site, and they reused their passwords.

Facebook scams a great for that, click a link you think is from face book log in, and bad guy now has you're face book account, and if you reuse passwords your email password.