Yes, it parses based on the from email. The short answer is that it doesn't protect against email spoofing. I do have some filtering set up, but it hasn't been effective in my testing.

However, you do receive a confirmation email after every new post. So if someone spoofed your email to make a post, you would get a notification email about that post. In the notification, you'd see what had been posted and could easily delete it. (Note that the email address associated with an account isn't made public anywhere, so someone would need to have doxxed you in this scenario.)

Of course, it would be pretty easy for a determined attacker to set up a mailbomb that flooded someone's page with hundreds of spoofed posts. At that point I would have to disable email posting for that account to stop the attack.

I'd be interested if you have any suggestions!