Carol is correct.
You can put any address you like in the FROM field.
Spammers put your address there because many people have their own address in their whitelist.
This trick will often allow their spam message into the system without being checked for spam.
Looking at the FROM address tells you nothing at all.
If you receive spam and it says Fron:
georgebush@whitehouse.gov would you really believe the President has resorted to sending viagra spam?
The only way to tell where a message is really from is to read the message headers. You need to know how they work because spammers can spoof many of those, too, but the ones they can't spoof are those in your data center and its really hard to spoof the IP of the sending server that connected to your data center. If you don't understand how to read the headers correctly, you can go to a service like SpamCop and paste the complete spam message, including headers and SpamCop can tell you exactly who is at fault.