Bounce messages are sent from/by the MTA that encountered the error (which is not always the one that generated the error)
They are just an email message like any other, and they are handled/routed just like every other email on the Internet.
Example 1: You send mail to an address that doesnt exist.
When your ISP's mail server contacts the recipients mail server it gets a 5xx "That person doesn't exist" message. Your ISP's mail server puts a bounce message in your inbox.
Example #2: You send mail to an address that doesn't exist. The recipient's mail server is behind a spam filter that accepts your message, scans it & tries to send it on, but gets the same 5xx message as in Example 1. The spam filter generates a bounce message addressed to you and sends it back to your ISP's mail server to be put in your inbox.