What about spoofed emails? Come to think of it, how does posterous handle that? One way would be to mail the user back asking them to reply to confirm and then recording the details of the genuine mail server. Does posterous do that?

On the whole there is a lot to get wrong in this authentication method. I would prefer if this doesn't spread to other web apps.