Indeed! And I do not know how to protect a mail server from faked headers! I mean you can just telnet the port 25 of a MTA and write whatever you want. Mail is a risk, remains a risk and will always remain a risk.