>Have they been hacked or have I?
Most likely neither..., but if it's either one or the other the chances are it's them, not you.
It's trivial to send mail with any 'From' address, so any spammer can send out any number of emails that look (at least at first glance) to come from any name/email address. Spam filters catch most, but not all.
It's possible that the sender's account has been compromised, which is how you might recognize the sender (the spammer is directly sending emails only to their contacts), but there's nothing on your system that would generate emails like this, so the fault is not yours. You might reach out to this individual to warn them that they appear to be compromised, but there isn't much more you can do about it.