I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have these mechanisms configured correctly and implemented.

In a scenario where the recipient does not have these particular mechanisms in place or misconfigured, could a spammer potentially use my email address to send the recipient spam? 

So far it looks like your organization relies on the fact that you have configured SPF, DKIM and DMARC correctly as well as all recipients, to completely prevent your domain from being spoofed.

Or am I misunderstanding something here?