Yes, if your website scripts and file/directory permissions are insecure, it is possible for someone to upload spamming script on your server and send out bulk emails from your server.

The mail logs will indicate the email addresses to which the emails are sent but unless you have proper mail server settings, you won't be able to find out the exact script that is sending the emails. By default the emails will be sent out as your server's hostname address.