If you're running any PHP scripts like phpNuke, phpBB, etc... Something like that, they could have found an exploit to send e-mails from your server, or perhaps buried a script somewhere to do it.
You might want to e-mail support or abuse about it and have them check it out. You can do that at
http://desk.surpasshosting.com/