it's not spam.
Globaliser is absolutley correct. Someone who has Tosh in their address book has contracted a virus which is spreading itself out from that person's machine but pretending to be Tosh (and usually everyone else in the address book) You should be able to track down the infected machine from the returned email.