Yes, your cousin will have accidentally given away his password to a scam site. The scammers can then access his/her account and send emails appearing to come from your cousin.
As an experiment, I set up a page to see if I could how gullible people were:
http://www.square-bear.co.uk/mitsuku/msn.htm
Within a few days, I had amassed a collection of over 50 or so genuine logins and passwords! Naturally, I did nothing with them apart from tell the person how stupid they had been.
Ask your cousin to change their password and the emails will stop.