"one of your minor employees isn't running a sideline in something they shouldn't." = where my mind immediately went as well.
overall, email spoofing is common
but this is for physical shipments, they're pretending you're the shipper... hmmm... with the lax controls the post office has, don't think you can stop this. if it repeats, perhaps a policy of not accepting return shipments w/o an RMA number? even that can be foiled easily.
i'd suspect somebody who wants to intercept your return mail, either an employee, your mailman, or the like.
i can't see any foolproof way of being victimized this way, nothing of short of new verification processes for anyone who ships anything, don't see that happening.