How do you forward a text?
But all that really does is copy the body into a new SMS. There's no metadata to indicate it's forwarded, as you suspect.
This means texting 7726 is a two step process. First you send the body. You immediately get a response asking for the phone number of the spam sender, so then you sent that.
I suppose it can be used to help the operator identify the actual incoming message in their logs?
Think of BCP38 for IP spoofing, but for number spoofing. If you get an appropriate country mobile number from a carrier in that country, are you going to pay for a portability lookup to confirm that carrier is the authorized carrier for that number? Does that carrier check source numbers for all of the connections they have?
Some of the aggregators are good at checking sources, and some aren't, but aggregators are often authorized to send messages from many different countries, so they're likely to have their connections unchecked, because keeping the list updated is hard. It's like IP transit, but a lot worse.