Just because they were using you as the "From" address doesn't mean they had access to your account. (Which doesn't get your app back online, of course.)