Spam attack

[Matt]

Are you sure they did not originate from your own mail server? check the email headers to be sure.

If your catch-all is off and you received a ton of bounces to a legitimate email address, then chances are one of your php scripts that has the mail function has been hacked.

It is probably the script that has bounced-user@yourdomain.com coded right into the reply-to header. That is where I would start is to think about the site and any scripts that have reply-to set to the email address that was bounced.