A few steps I take when troubleshooting these types of things for new clients when they’ve been hacked:
You can add your first site free to https:://mysites.guru which will then run an audit on your site and identify which files have potentially been hacked so you can remove malicious code and/or rogue files.
Reinstall Joomla via components > joomla ...
Really, get that Joomla installation at least up to the latest available release for that series, which would be Joomla 1.5.26
There is also a community patch which fixes a security issue found after Joomla 1.5 went EoL.
After that, make sure to check the whole site for hacked files. Refer to the official documentation what you should do when you detect a ...
Most likely spoofing but you may be able to use the Email Trace tool in cPanel (or similar) to check if an email was sent to a particular email address from the account. If there is no tool available for you to check this, you could ask your web hosting provider to check for you.
As you already realise, seeing the original email headers may help verify the ...
Yes, your site has been compromised.
Please, review the following checklist:
Security Checklist/You have been hacked or defaced
More info: What to do if my Joomla website got hacked?