Yep, SMTP itself doesn't have any security.

Anyone else remember the open SMTP relays of the 90's?

One could use aol's smtp servers to send mail as clinton@whitehouse.gov