You mention "I have determined my server is compromised". How have you made this determination? Have you found entries in your logs? Have you seen active logins? Etc.
Or are you making the assumption that your server has been compromised because you are getting bounce back emails you have not sent, or perhaps you are getting blacklisted as a spammer, etc.?
More specifics are needed on what you have found (facts not assertions without details) to be able to determine if you have been compromised and at least have a guess at the level of compromise.
As mentioned by others, the email headers are key in understanding what is happening with the emails received/sent so that can be quite helpful if you are tracking emails. As for your question, it is trivial to spoof sending addresses and does not require your system being compromised (in which case the headers would show the actual systems the email passed through and not your system).
As for diagnosing what may be happening to your system, start with the log files. Check logins to see who has been logging in to your system. Check active connections to monitor if someone may be sneaking on. Check your mail log to see if the emails are originating from your system - and for this, you then need to see if you are being used as an open relay or as a bounceback relay (someone sends to you as a bogus sender to an invalid recipient, your system bounces it back which means you are now spamming all these bogus senders and your IP is seen as the email sender).
Hope this helps to start with. Add more details and we may be able to provide more suggestions.