Hard to tell...
The message carried your return address, so it was either a genuine mail
from you, or a sender address was faked and your e-mail address abused
by third party, in which case we apologize for undesired notification.
It's possible that the spammers faked the sender address (using your customer's email address), but did not send the mail through your server.