I'd doubt it's been hacked mate. I'd bet you a fiver that it's just a email spam using your email address as a mask. It'll send it to thousands of email addresses and every now and again, your mate will get one that looks as if it's come from you and report it to you.
Obviously I don't know the full details here; but I bet that's the case?
If your email account has been hacked, chances are Google would clock it and lock it down pretty quickly.
And also, just in case, enable two-step verification so nobody can use a different computer to login. I think it texts you a one-time-use code when you use a different computer before allowing you to login even if you've used your password.