>>I'd still like to know how they do that, though.

Incredibly simple to do - Email spoofing. Not because I do it but because I needed to understand it in the past for work when we had a problem with people spoofing our addresses and our clients (in their naivety) thinking we were sending them viruses.