Receiving bounces for mail you never sent does not necessarily mean a compromise.
TWO DIFFERENT SITUATIONS
Spoofing: anyone can forge a From address, exactly as anyone can write your address on an envelope. No access to your account is needed, and your mailbox is not compromised.
Actual compromise: mail is genuinely being sent through your account. Track Delivery will show it.
TELLING THEM APART
Check cPanel > Track Delivery. If it shows no such messages, the mail never came from here and it is spoofing.
REDUCING SPOOFING
You cannot stop someone forging your address, but you can make receiving servers reject the forgeries:
A correct SPF record listing only your genuine sending sources DKIM signing enabled DMARC published, moved to quarantine and then reject once reporting confirms your legitimate mail passes
With a strict DMARC policy, most major providers reject forged mail claiming to be from you.
BACKSCATTER
A burst of bounces for mail you did not send indicates a spam run using your address. It passes. DMARC reduces it substantially.
