Rather than someone physically being at a location such as a public library, which may have their own servers running in the back room for whatever reason, most hackers prefer to spoof(fake) an email address rather than breaking into someone's account and sending mail directly from the real mail account. It is very simple to do once you know where to find email servers which allow open relaying. Email servers which allow relaying are used frequently by spammers. The reason for doing so is because it hinders you from tracing the spam back to its sender. That is why when you run a trace on the originating IP address in a spam email header, it will resolve back to the open relay email server. What are you going to do then? Go after the library or high school where the email was relayed through?
Open relay servers will let anyone connect to port 25 which is used for sending and receiving mail between servers and allow them to use ANY fictitious or real email account name they please. This is called spoofing, or faking an email account name. I could connect to one of these open relay email servers and send you an email from [email protected] if I wanted to. OR, [email protected] for that matter. I could then simply say to email me back at another address, say Hotmail, and ask you to "send me your login password to JWD because of a software upgrade that I need to test. Not to worry, I'm Simon and you already know me very well from my site. My jehovahs-witness email account isn't receiving mail right now its only sending, so that is why I need you to send it to my hotmail account." Do you see how easy a naive person could fall for that?
There are databases which allow you to submit email servers which allow relaying to be blocked. Such as ORDB and MAPS. These databases allow most email servers to query their IP address lists which show what IP's are allowing open relaying and being abused for spamming purposes. If a match occurs, an email server can be config'd to deny mail from IP addresses on their lists. Result? No more spam email pouring into your box. http://www.ordb.org/lookup/ will allow you to input an IP address and see if it is listed.
Bottom line is, unless someone is sniffing your network listening to all traffic over ports 25 and 110(both used for email) and capturing your password in CLEAR text, or you have a very weak password, 99% of the time when you receive an email from someone you do not know(literally), but the address is one you recognize, it is more than likely a hacker spoofing the email address through an email server which is allowing relaying.