Spammers are adept at forging the origin of their messages, and it is relatively easy to forge the "FROM" address on an email, just as it would be easy to write anyone's return address on an envelope. If you get a message that claims to be from you, it might be spoofing rather than originating from your email account; it doesn't necessarily mean you've been hacked.
Because of a forged "FROM" address, you might also be getting bounced-email notifications about emails you never sent. Again, this doesn't necessarily mean a hacker has real access to your account, just that a spammer was hiding behind your email address.
On the other hand, cracking passwords for free email sites (Hotmail, etc), or other sites with weak security, is an easy in for hackers. Now might be a good time to change your password — be sure to pick a strong password for all your email accounts, and remember: your SUNetID password should be different than every other password you have.