This question already has an answer here:
One of my clients is getting thousands of "Delivery Status Notification (Failure)" emails per day and it's replied to random email accounts that don't exist on the domain. The content of the emails that bounce back have spam links to porn sites. So someone is obviously using the domain to send out spam, but i'm not sure if they've hacked the server or if they're just spoofing.
I have been looking into the email settings in cPanel to see if I can restrict this. I came across the DKIM and SPF settings under Email Authentication. I've enabled both of these but the emails keep coming through.