This sort of behavior is a known problem, see Privacy Rights Clearinghouse 'Resume Database Nightmare: Job Seeker Privacy at Risk'
One solution for the future may be to put a copyright notice on your CV, as recommended by
'Let the resume wars begin' - Ask the Headhunter (Nick Corcodilos). Then you can use a simple DMCA takedown notice. (To my knowledge, job-boards will not accept CVs with copyright notices. But this is a plus, not a minus, since there are compelling reasons to avoid job boards, as per the article. One is to prevent stale copies of your resume being downlaoded, retained and passed off (sometimes years later) without your knowledge or consent - relevant to your issue here.)
But obviously your immediate priority is to track down which source/job-board/recruiter this happened with.
When you figure it out, let us know as a community service.
We don't know who is actually behind it but whoever it is has been
applying for roles using this CV. As for why, we have a hypothesis
that it's a recruiter trying to get the inside track on active roles
but this is only a hypothesis.
Yeah that sounds plausible. It wouldn't make any sense that they were trying to harm you personally, just using you as fodder to get their foot in the door at new clients, and your reputation might get harmed in the process. But it's clueless and unethical. You may be able to get them blacklisted.
Presumably they hoax the email address to go to them, in which case you might be able to contact 'them' by email and then have proof they are doing this.