MudGuard is right about how easy it is to fake email addresses. I do it about once a quarter when a manager tells me they want email from a certain address sent through our virus programs unchecked 'because they can trust' that address. I tell them I'm about to send a fake email from that address and about a minute later they recieve it.

They tend to be a little more careful about security after that.