that sounds like you were hacked.
first thing would be to search the shop files for the email addresses I think. If you have ssh access to your site you can do this by executing
grep -r "firstname.lastname@example.org" /your/magento/root/directory
If you do not find anything, you should search your database for the email addresses (with phpmyadmin for example you can search in all tables)
You also should change your admin user credentials, change the admin url (in your app/etc/local.xml) and deny access to your /downloader dir over the webserver. Very likely, someone had access to your magento admin account and installed an extension that adds the admin accounts (this can also be installed under a well known extension name but with different code).
If you have your code also in a Version Control system like git or a backup (or whatever) you should reinstall the shop from there, since it is possible that Magento Core (or other modules) files where edited to (for example) send sensitive data to anywhere
also, before i forget, be sure to install all security patches from the official magento homepage