Exactly! That's how it's usually done. So I wonder how it is possible that PN noticed this:

In reply to a post by Enceladus:

During Monitoring of our platform we noticed a number of unsolicited emails are being sent from a remote IP address using your account login credentials.

The spoofed emails in the way you say would never go thro' PN's platform.

Unless PN are saying that the spoofer, from the remote IP address, is using the PN SMTP with the OP's creds. That would be a compromisation of OP's a/c.

Are users on another ISP allowed to use PN's port 25 SMTP? If not, that would indicate spoofer is a PN user. Or does PN have a non-port 25 authenticated SMTP? That might be what PN is getting at.

Ah, yes. Forgot that part of the post - that's what happens when I don't reread a thread. That does suggest that the account itself was compromised.