Nah, it's nothing to do with him or his computer. It's called "spoofing" - and it is possible to change the "from" field from their name to your cousin's. Heck, I do this all the time at work, legitimately - when responding to our tech support inbox, I change the "From" to read "Technical Support."
The spoofer doesn't need access to your cousin's computer, just needs to pull the name of a mailing list they bought somewhere, and put it in the "from" field. And here's the real bitch: there's nothing you can really do about it other than delete it, as they have similar ways to hide their IP address.
I will not be pushed, stamped, filed, indexed, briefed, debriefed, or numbered. My life is my own. --#6