Receiving a bounce or a complaint about mail you never sent does not necessarily mean your account is compromised.
TWO DIFFERENT SITUATIONS
Spoofing. Anyone can forge a From address, exactly as anyone can write your address on an envelope. No access to your account is required. Your mailbox is not compromised.
Actual compromise. Mail is genuinely being sent through your account. cPanel > Track Delivery will show it leaving the server.
TELLING THEM APART
Check Track Delivery. If it shows no such messages, the mail never came from here and it is spoofing. If it does, treat it as a compromise and follow the compromised mailbox article.
REDUCING SPOOFING
You cannot stop someone forging your address, but you can make receiving servers reject the forgeries:
Publish a correct SPF record listing only your genuine sending sources. Enable DKIM signing. Publish DMARC, and once reporting confirms your legitimate mail passes, move the policy to quarantine and then reject.
With a strict DMARC policy in place, most major providers will reject forged mail claiming to be from you.
BACKSCATTER
A burst of bounce messages for mail you did not send usually indicates a spam run forging your address. It passes. DMARC reduces it substantially.
