Somone is sending spam from our domain

Somone is sending spam from our domain

Hi,

Someone is sending spam from our domain with a part from our contact list in "cc", we have SPF record setup, we changed already password, we even enabled 2 way authentication but still this spammer is able to send mails with our domain with a part from our contact list in "cc".

Can anyone help us?