I am by no means a security expert, and there are many here who know more about this than I do, but there are two other possibilities I would consider here: 1. Your host has been compromised, or 2. You have a keylogger or other similar malware on your computer that your scan failed to detect.
If I was in your situation I would focus on #1 first. Who is your host? Are you on a shared server? What kind of reputation do they have? Have they been blacklisted anywhere? Check your server IP here: http://mxtoolbox.com/blacklists.aspx