There is currently a bug that I stumbled across that allows for spoofed emails to be sent.

If you have a Live account that has an external e-mail address Microsoft allows you to login here, without any additional authentication credentials, and actually will send e-mails using the account's original address. In my case this was my Gmail address.

Overall the requirement of Silverlight is a little annoying, but the same as usual for Microsoft. The UI itself doesn't look bad, and I actually prefer it to generic Gmail theme.