This is the nature of how email works, unfortunately.
There is nothing preventing you or I from sending an email from any address we choose, this is by design. What we can tell though is the IP address the email originated from in the mail headers, and this will give us an idea of where the original message came from.
In the old internet, most mail servers were run as open relays. This means that to send an email from yahoo.com to google.com, you could use any open relay you found on the internet. If the IP got banned, its okay because it isn't your IP, and you could just change relays.
Now, with most modern mail servers, this isn't really an option. SMTP servers will only relay a message if you are authenticated, preventing random internet users from abusing your services. The server would accept unauthenticated mail only for users on that particular mail server.
Due to this change, spammers now need to completely compromise mail servers in order to abuse them.
If an attacker compromises your server, there isn't much you can do to stop them from sending emails short of blocking outbound port 25 on the firewall. If you need to run a legitimate mail server, then this becomes a problem as you would be denying legit email from being sent.
Also, I would check your IP against any blacklists. It may have ended up on some lists and you would then need to submit a delist request, including how you resolved the issue.