[thebeefytaco]

Click the Details link next to the Last account activity line at the bottom of any Gmail page.

That will give you a list of IPs signing into your account.

I get a lot of those failed delivery messages though because I have my own domain via google apps. Someone scrapped my mail domain and fakes it in the headers, but I get the actual replies because I have it set so all addresses on the domain go to me.

[codingfounder]

As I noted in my post, I have already looked at the login activity list, and there's nothing other than my own IPs and sessions.

I have a similar domain via google apps setting that you have. I just don't understand how they got hold of my contacts, and don't know what I can do to prevent them from spamming my contacts again.

[axelfreeman]

Please check your pc. Is your OS, browser and browser-plugins up-to-date? Is there a browseraddon you haven't installed? Make a full virus scan.