quoate:
This one confuses people because the bounce is real, but the original send wasn't yours.
A spammer can forge your address as the visible sender, blast junk mail elsewhere, and then the failed messages bounce back to you. That creates the impression that your domain is sending mail it never sent. Community guidance discussed in this Spiceworks thread on postmaster backscatter notes that SPF, DKIM, and TLS do not fix backscatter once a receiving server has already accepted the message.
That's a key point. People often assume authentication should stop every fake postmaster email. It won't. Authentication helps reduce spoofing risk, but it doesn't undo a bounce generated after another server already accepted forged mail.
Now why in the hell would an email service use the address showing in the From field when that is spoofable. They should be using the Sender (@) field. In Thunderbird, for example, I can show both as columns in the inbox. I can easily see when the Sender address does not match the From address, and then I know what's what. Surely an email service can do the same.