So I'm rather suddenly getting hundreds of bounced message notifications in my inbox, but I'm not sending messages anywhere. I'm trying to track down if something stole a password or session cookie somehow, or if someone is just spoofing my outbound smtp address, and I'm not sure how to figure this out, since google is a bit of a black box.

The e-mails are using a non-existent address that's bouncing to my catchall address, which is also my personal inbox as I'm the administrator. I host gsuite for my family so we can all share e-mail addresses. I've tried to reach out to google support, but their chat bot won't let me because I don't want to upgrade to business premium and pay more for my family's gmail accounts.

So My first thought was to check the rate of outbound mails going through the gmail SMTP server and see if it's higher than usual, and to set an "E-mail Sent" alert and have it logged in the console. I can't figure out how to do that. However, I don't see any suspicious logins for any account in the family, and don't see in the little graph they provide a matching number of SMTP events, though I also don't know how up to date that graph is, as this just started happening.

Please advise, how can I figure out if I'm sending the mail, or if someone is just spoofing my domain to look legit?