Jane, "bouncing" spam is utterly useless, since 99.99% of spam comes from users who forge the sending address. Mail isn't quite smart enough to sort that out, so the bounce just goes to either a non-existent email address or some poor sod whose email address has been purloined for this purpose.
Which email address is generating all the spam? If it happens to be the one associated with your web site, the reason is that your email address is sitting there out in the open, just waiting for a spambot to happen along. It only has to happen a few times and you end up on a list of email addresses that gets sold and so on, and so on.
HIDE your email address on your site!! Although I've read that "some" spambots can read this too, in practice I find it almost 100% effective. In the code for your email address, remove the "@" and put "& # 64;" - without the quotes or the spaces. That's the ASCII text for the "@" symbol and most spambots ignore it.
Even if the email address on your web site is NOT the source of all you spam, you'd be wise to hide it, because sooner or later, it will be. Also, if that email address is not a vital one that you actually use a lot, dump it and make up another one to use in association with your site - and hide the "@" of course. (You should be able to add an email address in the control panel for your web site). If you can do that, say goodbye to ANY spam from the web site.
If the spam is coming in on other email addresses, try to figure out why. Where have you used your email address? Is it "out in the open" somewhere on the web? Have you signed up for anything on a site that may not have been trustworthy?
Use a "throwaway" email address for ANYTHING that is not important/frivolous/untrusted. I have several levels of "trust" - I use my personal email address from my ISP for friends, very secure online ordering (sites like Apple, Amazon etc.) and that's about it. Forums and memberships (Facebook etc.) - still trusted, but not top-tier, get my gmail address. Everything else gets one of my Yahoo addresses. And I have a completely different email address on my web site, so that I know that anything/anyone using that email address got it from the site. If I start getting spam, no problem - I change the email address on the web site. (Any legit contacts through the site will be responded to via one of my "real" email addresses.)