A spammer is using the main email address for one of my sites to spam people for a VPN service running out of Eastern Europe (sent from). I've contacted the VPN service. They say the emails are being sent by an affiliate not them, and they have no control over the affiliate, and don't know who it is. I am not sure that I believe this as the email is generic and does not seem to contain any information to identify a particular affiliate.
I am getting the bounces, and am concerned about my domain being blacklisted. Does anyone know how to fix/deal with this kind of situation?