> Or are you saying that you can make this person's server serve third-party content?

Http: yes see OP

Email: not sure. Hopefully not. But spoofing happens.