What's actually happening
Email's "From" address was never designed to be trustworthy on its own - it's closer to the return address written on a paper envelope: anyone can write anything there. Three records in your domain's DNS are what let a receiving mail server tell real mail from forged mail: SPF (who's allowed to send), DKIM (a signature proving the message wasn't altered), and DMARC (what to do when a message fails both).
If your domain has no DMARC policy, or one set to p=none, forged mail using your domain name gets delivered exactly like real mail would. That's what's happening right now if this is news to you.
See where you actually stand
Type your domain into the checker. In a few seconds you'll see your current SPF, DMARC and MX records read live from public DNS, and exactly where you sit: no policy, p=none (reporting only, not blocking), p=quarantine, or p=reject (forged mail gets refused outright).
Shutting it down without breaking your own mail
Jumping straight to p=reject is tempting but risky: if you have a sender you forgot about - a marketing tool, a support desk, a billing system - sending mail using your domain that isn't yet aligned, you'll block your own legitimate mail along with the forged kind.
The safe order: publish a policy that only reports (p=none), read a week or two of reports to find every real sender, align each one, then move to quarantine and finally reject. The full walkthrough is in moving DMARC from none to reject safely.
If it's actively happening right now
Forged mail using your domain doesn't mean your mailbox or password is compromised - don't waste time on a password reset. Do: warn customers who reported it not to click anything in those messages, and move your DMARC policy toward enforcement as fast as your legitimate senders allow.