How is someone sending text messages to friends when I have my phone?

Once upon a time there was a technique called "spoofing", not sure if it still works. You basically provide a number you want to simulate, provide your own, then you can call and send texts pretending to be the other person. This is not limited to iPhones and has nothing to do with iOS issues ... in fact I'm not sure if it even works with iPhone accounts, and I don't think you can spoof an iMessage just regular text messages.

Are they logged on using your iMessage username and password?

It's quite possible that whom ever is doing this, is using an online messaging page. Basically they can put any number they wish as a return number, your's, and then send out bad messages.

KOT