This is a scenario I've noticed more and more recently - a friend's email accounds get hacked, it sends out loads of spam for all sorts of questionable things, and then a follow up email from said friend arrives to apologize and to declare their email account was hacked.
Your email was hacked.