In my admittedly scarce experience of these scary events, the most likely explanation is that the agent abusing your mail server is a spammer. This jibes with the reply you had, "Too many recipients..."; anyone aiming at stealth would not flag his activity this way.
Once a mail server is known to be compromised, it is open to infiltration by just about anyone with adequate skills (in this case, given the lack of authentication, not much is required in terms of technical knowledge), but serious offenders tend to protect the resources they infiltrate by preventing others' abuses to alert the local IT people. So, the most likely scenario is that you are being infiltrated by a spammer, and that's it.
At this point, your most pressing risk is that of blacklisting, as noted aptly by Dave Rook. The question at large that you should ask yourself now: besides my mail server, what else has been infiltrated? That will require a serious forensic effort.