Question with emails need an answer fast

I have just noticed that in my sent folder every now and then another web site on the same hosting company, is sending emails with my email address. This is an email address that has never been published or released past my own head, and I have changed the password 5 times in the last 6 hours to have it continue.

Now I have setup ContentBox to use the mail server, username, password etc, that is define in the dashboard for ContentBox. So my question is how can this go be using my account to be sending emails?

It is also another ColdFusion website, and it is actually running Mura. I have spoken to the guy and the hosting provider and both are baffled to how this can happen.

It is almost like he is hijacking my application or session or something, it just doesn’t make sense. It is my from email address with his to email address and none of us can work this out.

Anyone have any ideas?

I am almost going to blame ColdFusion and caching here, because I can’t see any other valid reason.