Hacked - or spam?

I just got this message from my system:

Start email send - Total queued emails: 20 Ready for send: 20 Processed emails: 20

Plus I got an out of office reply from someone I did not send a message to.  My site has low activity, and I don't see where any of the members have been recently active.  How can I find out what is being sent out?

Sorry, I probably should know this, but I don't - are messages that are sent by the system saved in the database, or anywhere?

anyone?  Where are messages stored in D7?

I didn't think they were. I'm sure you can ask your web hosting provider regarding any outbound emails that seem suspicious.

Well maybe they aren't - but for some reason I always thought they were.  Are the PMs stored anywhere?  Just weird to see that Periodic Report telling me at least 20 messages were sent, when no one was on the site at the time that I can see.  I also got that one "out of office" reply I mentioned from someone I hadn't written.  Does anyone have a guess as to what might have happened, and how I can investigate?

In tools, mass mailer you can find in the drop down what messages you have sent in the past. If you clicked by accident 2 or 3 times it will be sent 2 - 3 times without seeing it at first. It shows sometimes later. You can see how often one message was sent. I haven't figured it out yet of where the messages are stored.

I don't think I clicked that link by accident, and I have also written my host to see if they have any information.  If anyone else has any ideas please let me know - I am pretty sure it sent something out.