Can anyone explain how it is possible to receive e-mail, seemingly from your own e-mail address (both To and From are identical) but is actually from some spammer? I am trying to understand the security risks here.

It's actually quite simple. When you setup your mail client you tell it what your email address is... you can enter anything you like and that's what will show up as the from address when mail is sent. You can then address the email to whomever you want, even if it's the same name that was used when setting up the mail client.

Having said that, spammers don't use mail clients like Outlook or Thunderbird they have programs that pull from lists of email addresses, they can use anything they want as the from address and often times the address they're sending to is the easiest thing to use.

Some mail servers will check to make sure that the domain name that's used in the from address is actually the domain the email was sent from. If it's not the message can be flagged as spam or some other notification placed on the email so it's obvious that the sender is possibly not who they say they are.