they can only use your IP directly if they are relaying through your equipment, or are in front of you in the network path. the former is certainly possible and common, the latter is very very far fetched really... they can use your IP address within SMTP headers which could contribute to being black listed, but not to actually use it to send mail from, that's just not possible.

The only IP I see in common for mail for those domains (per senderscore) is 82.151.73.160 ( MAURITEL-MNT Africa) and there is no rDNS entry associated with that IP address..

If this is your IP, I thought you had rdns setup for it ? or did I locate the wrong IP address..

While they have the 3 domains you mentioned listed for sending mail from that IP address, there is no fourth domain listed.. like the legitimate domain that would be yours..

I'm confused, and feel we are not getting the entire picture.

Your IP address is static isn't it ?

am using SENDMAIL

yes , i have an rDNS but sometimes it doesnt appear when you look, before they were 5 domain but now they're only 3...

Have you yet determined if they are using your mailserver or if they are on a computer behind your gateway? If they're on a computer behind your gateway, it's likely that one or more of your systems has been compromised. (Or is being used for an unauthorized purpose by an authorized user).

when i check log i didnt find any NON-auth outgoing mails, so i think it is one of my machines but i didnt determine which one ..