The way mail worms typically work is they "create" email addresses based on existing addresses found on your system and the system of people on your email contact list, or the lists of their contact lists, etc etc.
So if
jack@hotmail.com sends an email to
jill@lycos.com, and jill has a friend at
joan@yahoo.com, even though jack has never emailed joan, he may get an email that comes from an address like
joan@hotmail.com,
jill@yahoo.com, or even
jack@lycos.com.
I've gotten an email "from myself", even. And several emails that are supposed to have been sent from people on my own damn domain.
Never trust the "from" field alone, look at the header and ask yourself if this email looks weird. If it walks like a duck and quacks like a duck, it IS a duck.